Why Planes Crash: Aviation Accidents of 2001 - Linate, Bilbao, Aspen and More

No part of this book may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or by any information storage and retrieval system, without permission in writing from the publisher.

The name EQP BOOKS and its logo, consisting of the letters “EQP” over an open book with power cord, are registered trademarks of EQP BOOKS.
http://EQPBooks.com

Acknowledgements

Thank you, as always, to Cliff Stanford, both for introducing me to flying and for never balking when my enthusiasm overflowed. And also a belated thank you to Lee Dumbleton for teaching me to love everything about the Piper Saratoga, even when I was convinced it was trying to kill me.

I’d like to extend a special thank you to Simon Spruck, Yamaguchi Yoshiaki, contri, anynobody, Cybergothiche, Carrie Schmitz, Shahram Sharifi, Noel Jones, Dean Morley, Martin Varsavsky, Sören Karleby, Ken Elliot, Andres Rueda and Noel Jones for making their photographs and illustrations available as a part of this book.

A shout-out to PPRuNe and /r/aviation, my two favourite sources of aviation discussion, even if we don’t always agree.

Excellent editing and production were provided by EQP Books. Any remaining errors are my fault and despite the careful ministrations and admonishments of the editor.

Introduction

WHEN I FIRST CONSIDERED this series, I knew I wanted to focus on modern failures. I’d been invited to London to speak on Aircraft Confidential, the Discovery television show highlighting famous aviation disasters. Many of the fascinating, frequently talked about aircraft failures like Aloha Airlines losing its hull or the fast spreading fire of Swissair 111 are lacking resonance for the flyers of today. They are historically interesting but not immediately pertinent to modern aviation. These are accidents which will not happen again, often as a direct result of the efforts of investigators of the time. I find them endlessly fascinating; however I am even more intrigued by real-world problems which we are still experiencing in aviation.

The question now is really: Why do planes still crash? By concentrating on modern crashes, we can focus on the issues of today and understand what can be done to continue to keep aviation safe.

It is often too easy to point at the pilot. He is a single point of failure who can be blamed without financial repercussion for the airline, without requiring lengthy legislative amendments by the governments, without requiring changes at manufacturing plants. A single reputation is destroyed, sure, but millions in man-hours and money are saved. That’s the efficient answer and, thus, the one we should arrive at only when the other factors have all been investigated.

This is not to say that pilots don’t make errors, or that those errors should be disregarded. However, when considering the incident, we should be asking ourselves what the reasonable repercussions of a mistake are. A pilot who gets lost in an airfield and queries his position should not be left to blunder forward onto an active runway. A passenger who insists that he must get in at all costs should not be able to pressure the pilot into reckless behaviour. And attending advanced training certainly shouldn’t result in bad habits being taught which put the entire aircraft at risk. All of these accidents and more are covered in the pages to come. Some are more technical than others and require more time to explain, but I am hopeful that every analysis is interesting to pilots and passengers alike.

This book covers eleven accidents and incidents which took place over the course of 2001. Each section includes text quoted directly from the accident report. If you’d like to read the original accident report for more information and context, then simply skip to the end of the section where you’ll find a link to the original report.

In each chapter, I cover the core chain of events which led to the accident rather than making a simple judgment. Accidents are invariably a combination of factors, and pilot decisions and (in)actions can be the result of a culmination of those factors. A strong investigation will not only consider the cause but the contributing factors: those actions or inactions which could have saved the day but didn’t. The objective in accident investigations around the world is not to cast blame, but to understand every aspect so that we can stop it happening again. Unravelling the mystery from the wreckage is the most important step.

Lost in the Fog

THE CESSNA’S FLIGHT PLAN reported the crew as instrument rated for an approach down to a minimum visibility of 550 metres. At the time, the visibility at Milano Linate Airport was 100 metres with fog and overcast at 100 feet: much less than the flight crew required for a safe landing at that airport.

Despite this, the Cessna pilot decided to continue. The controller on the Tower frequency, having warned him of the low visibility, cleared him to land on Runway 36R, the Pista principale.

There are two aprons—the manoeuvring areas of an airport where aircraft are loaded/unloaded and able to park. At Milan, the North apron serves the Pista principale for large transport-category aircraft. The West apron, next to the Pista turistica is available for the smaller General Aviation traffic using the short runway. Until fairly recently, it was easy to keep the two types of traffic separate. But as General Aviation aircraft have become more powerful, it has become more common for “small” planes at the West apron to require the longer Pista principale.

The airfield has with two runways that run north/south: on the right is the large runway with taxiways that connect it to the North apron. On the left, is the small runway with taxiways at the top and bottom. These taxiways start at the West apron and carry on past the small runway to the large runway. The main taxiway runs parallel to the Pista principale for its full length. Four connecting taxiways are numbered clockwise starting from the north. R1, R2, R3 and R4 connect the main taxiway to the Pista principale. These are used by the large transport-category aircraft using the North apron and are not all that important to our story.

The remaining taxiways do not follow the clockwise convention. Next is R6, which runs from the West apron along the bottom (the south threshold) of the Pista turistica and then continues to the mid-point of the Pista principale. Finally, R5 is at the top of the airfield, passing the northern thresholds of both the Pista turistica and the Pista principale to the North apron.

The German Cessna landed on Runway 36R (northbound on the Pista principale) at 04:59:34. The aircraft passed the intersection for TWY R6, which connects to the mid-point of the Pista principale. The pilot requested permission to backtrack so he could use that taxiway to proceed directly to the West (GA) apron.

D-IEVX: EchoVictorXray on the ground, we could do a short back-track, to turn off to General Aviation.

Tower: DeltaVictorXray roger, on the ground on the hour, report runway vacated on Romeo 6.

The Cessna had already submitted a flight plan for the next flight: 05:45 hrs from Milano to Paris Le Bourget with two passengers on board. Once clear of the runway, the Tower controller asked the Cessna to contact Ground Control, who are responsible for movements on the airport excluding the active runways.

About forty minutes after the Cessna made its request to backtrack, Scandinavian 686 (a McDonnell Douglas MD-87) contacted Linate Ground Control from the North apron, asking for engine start clearance. The commercial flight from Milan to Copenhagen had 104 passengers on board.

Scandinavian 686 commenced their ground operations. They contacted Ground Control, the air traffic controllers responsible for movements of aircraft around the airport, including taxiways and inactive airways. Scandinavian 686 received taxi-clearance at 05:54:23.

Ground: Scandinavian 686 taxi to the holding position Cat III, QNH 1013 and please call me back entering the main taxiway.

Four minutes later, the Cessna at the West (GA) apron requested start-up clearance and was given a slot time of 06:19 hrs for take off.

For a few minutes, the two aircraft were on the same frequency but then Scandinavian 686 contacted Tower, who control traffic on the runway. From this point on, the two aircraft were unable to hear each other’s calls. They had no way to know what the other aircraft was doing other than by looking out the front. In the early morning fog shrouding the airfield, that was no help.

Milan Linate Airport had clear procedures in place for low visibility conditions in order to keep the aircraft safe. What they didn’t have is an ASMI.

Normally, the key to tracking ground traffic at a large airfield is the Aerodrome Surface Movement Indicator (ASMI) radar which makes it easy to track the aircraft as they move around the airfield.

Milano Linate Airport was equipped with analogue ASMI radar but it was old and apparently was becoming unreliable. In 1994, the civil aviation Air Navigation Service Provider began planning for the installation of a new radar system.

The project became stalled in 1995, with concerns raised about the costs. The airport was advised to “avoid the acquisition of equipment that would become obsolete in view of the rapid technological development in this area.” In other words, don’t replace the unreliable system with a new one, because a newer new one in a few years might be better and then we’ll have to buy another one. This is a common issue with new technology but most people go ahead and take that risk at the point when the need for a replacement becomes desperate.

In November 1999, a Notice to Airmen (NOTAM) was released that the ASMI radar was out of service. Two years later, on the 8th of October 2001, Milano Linate Airport still did not have a functioning Surface Movement Radar.

Airports not equipped with ASMI radar have three conditions of visibility for low visibility operations.

In Visibility 3 conditions, departing traffic should be assisted by a FOLLOW-ME vehicle. All traffic would halt when the runway was in use.

The aircraft would only taxi when landing traffic had reported arriving at the parking bay and departing traffic had already taken off.

In other words, if Milano Linate had declared Visibility 3, the Cessna would not have taxied to the runway until after Scandinavia 686 had departed and would have had a lit vehicle to show the way.

At the time, the decision to declare Visibility 3 conditions was based on reports from the pilots. The controllers had no other method for taking this step. Only when a pilot thought to report that visibility was so bad that he could not taxi safely would the airport declare Visibility 3.

The pilots didn’t know this. There was no reason to assume that their reports were required. If the airport had not declared Visibility 3, then it must still be safe to taxi.

One report was received that morning: a concerned pilot said he thought he saw a vehicle moving near his aircraft while he was holding for Runway 36R. This was not considered sufficient to re-assess the current visibility situation.

On that foggy dark morning, the Runway Visibility Range (RVR) (measured at points with high intensity runway lighting) was less than 200 metres. At the West (GA) apron where the Cessna was starting its taxi, the visibility was half that value or even lower.

Ground: DeltaVictorXray taxi north via Romeo 5, QNH 1013, call me back at the stop bar of the . . . main runway extension.

D-IEVX: Roger via Romeo 5 and . . . 1013, and call you back before reaching main runway.

This is what’s called a “partial read-back”. The Cessna did not repeat the full instruction and more importantly, refers to the main runway, rather than the main runway extension. It should have been corrected.

Here are the markings that the Cessna was expected to follow as it taxied from GA parking to the taxi-way:

Taxiway R5 and R6 both had a green lights centre line. Upon exiting the West (GA) apron, the two runways split, TWY R5 going left and TWY R6 going right. Even in bright conditions, the difference between the 5 and the 6 is minimal. The green lights for TWY R6 light started about 80 metres from the split. The TWY R5 lights did not start until about 350 meters from the split. Visibility even under the bright runway lights was less than 200 metres. For the pilots in the cockpit, squinting through the fog at the green lights in the distance, the TWY R5 lights could not have been visible.

The Cessna was rated for CAT I landings: a precision instrument approach and landing with a decision height not lower than 200 feet (61m) above the touchdown zone elevation. This requires making visual contact with the runway. A CAT I approach requires an RVR of not less than 550 metres. The reason that many commercial flights can continue to function in bad weather is that they are rated for CAT III landings. CAT III landings are in circumstances where there are not sufficient visual references to allow for a manual landing. The aircraft must have an automatic landing system in order to land in CAT III conditions.

CAT IIIa is 250 metres RVR, CAT IIIb is 175 metres RVR. On the morning of the incident, Linate was in CAT IIIb conditions. If visibility had worsened at all, the airfield would have closed.

The important point is that the aircraft must be equipped for CAT III ILS operations and the aircraft crew must be certified. The Cessna was not equipped for CAT III operations and neither of the crew was certified. They were attempting to get by visually in conditions that did not allow for it.

The fact that the aircraft was even out there in reduced visibility conditions should have alerted airport authorities. Someone should have at least checked with the crew to clarify. But no one noticed.

The Cessna crew were instructed to follow a route that had minimal signage and markings. There was no radar monitoring of ground movements because the ASMI had been out of service for two years. The West apron had inadequate signage and lacked proper markings. On top of all that, the lines painted on the ground for the taxiways did not match the taxiways in the AIP / Jeppesen maps.

And finally, although the visibility was so bad the airport was on the verge of having to close, there was no move to declare Visibility 3, which would have offered the aircraft a FOLLOW ME vehicle to show the way and restrict its movements during take-off and landings.

And so, into the fog, the Cessna began to taxi. Let’s look at the controller’s instruction again:

Ground: DeltaVictorXray taxi north via Romeo 5, QNH 1013, call me back at the stop bar of the . . . main runway extension.

D-IEVX: Roger via Romeo 5 and . . . 1013, and call you back before reaching main runway.

The yellow taxi line leads towards the south and then to the east, where it splits: left to Romeo 5 and right to Romeo 6.

The taxiway centre lights for Romeo 6 was located at about 80 metres from the split. The closest centre light for Romeo 5 was about 350 metres from the split. Visibility at that point was around 100 metres. Only one set of lights could possibly be visible in the fog. The Cessna followed the route for Romeo 6.

Now, the pilot correctly read back Romeo 5. However, his actions and decisions all imply that he believed that the aircraft was cleared for the same route he had followed to the GA apron a few hours earlier: Romeo 6. This is furthered by the readback: the pilot dropped every descriptive phrase which did not make sense if he was to taxi on Romeo 6: taxi north, stop bar, and runway extension.

Romeo 5 had all of those things. Romeo 6 had none of them. But no one corrected him when he dropped those phrases.

A second aircraft at the West apron, LX-PRA, was cleared to taxi the same route. Again, the stop bar and runway extension were mentioned as a part of the instruction. This exchange took place in Italian.

Ground: OK RomeoAlpha taxi north Romeo 5, QNH 1013, you must follow a Citation marks Delta IndiaEchoVictorXray who is also taxiing on Romeo 5. Obviously he is not in sight, and the clearance limit for you is the stop bar of the extension of the main runway on Romeo 5.

Again, the ground controller received a partial readback and again, he did not correct it.

As the controller and the flight crew spoke in Italian, it is unlikely that the Cessna crew took it in or had the chance to re-consider the key information repeated: stop bar, extension of the main runway.

There was not a single vertical sign indicating TWY R6 for the entire length of the taxiway. There were no markings to alert the crew that they were following Romeo 6 rather than Romeo 5 as instructed. The Cessna followed the green centre-line lights, which simply reaffirmed their belief that they were following the correct route.

As they passed south of RWY 18R, the Pista turistica, the pilots noticed two markings on the ground: S4 and S5. The pilots would not have found these location references on any maps: they were not marked in the AIP Italy, nor in the Jeppesen charts.

S1 and S2 were marked on Romeo 5. There was no S3. Instead there were two S5 markings and then an S6. The investigation found that there was no documentation whatsoever regarding these markings or their intended meanings. They appear to have been part of an abandoned project to increase parking stands on the West Apron.

The Cessna crew contacted Ground to give an unsolicited position report, possibly the last chance for anyone to recognise that the Cessna was on the wrong taxiway, heading directly for the mid-point of the main runway.

The controller did not have Sierra 4 marked anywhere on his map. He didn’t know what they meant by that update. Instead of investigating further, he disregarded the information. The controller simply presumed that the Cessna was correctly north of the two runways on Romeo 5.

The Cessna crew, having clearly stated their location, presumed that the controller had confirmed they were on the correct taxiway and thus that they were safe to proceed in the fog.

The ground controller contacted another aircraft, asking his position at the North apron, near the beginning of the main taxiway. They spoke in Italian, so the Cessna pilots would not have been able follow the conversation. The controller was cautious in the low visibility, taking time to verify that the route was clear for the Cessna to continue its taxi north of the runway. But that’s not where the Cessna was.

Ground: DeltaVictorXray continue your taxi on the main apron, follow the Alpha Line.

D-IEVX: Roger continue the taxi in main apron, Alpha Line the . . . DeltaVictorXray.

The Ground controller still had not realised the significance of the Sierra 4 position report. He clearly believed that the Cessna was at the lights bar across Taxiway R5.

The Cessna crew were lost, but they reinforced the controller’s presumption with their readback. They did not notice the inconsistency between the clearance received and their actual position.

At the same time, the Tower controller, on a different frequency, cleared Scandinavian 686 for take-off on Runway 36. The Cessna crew, listening to the Ground frequency, could not hear the call. The Cessna taxied on.

The Cessna crew continued forward on Romeo 6 towards the Pista principale, the active runway. 180 metres before the runway, the aircraft passed a STOP marking painted on the black asphalt. The Cessna then crossed a yellow runway-holding marking. The crew did not react to any of these warnings.

Ahead of the Cessna was a unidirectional lighted red lights bar and a lighted vertical sign, which said CAT III in white on a red background. These lights were not controllable by ATC since 1998 so were permanently left on. These were all markers of an active runway.

Milan Linate also had an anti-incursion sensors system that alerted the controllers immediately in case of an unexpected aircraft crossing into the runway. However, the system was deactivated in 1998. The investigation was not able to find any documentation as to why the anti-incursion sensors system was deactivated and by whom.

Meanwhile, on the Tower frequency, Scandinavian 686 confirmed the instruction from the Tower controller.

SK 686: Clear for takeoff 36 at Scandinavian 686. When . . . airborne squawk ident and we are rolling.

The Cessna crossed the red lights and the final yellow runway-holding marking painted on the asphalt. The pilots were so convinced of their route that they somehow managed to blank out every piece of information which might have saved them.

The following cognitive elements were not sufficient to raise doubt in the pilot’s mind:

the clearance received from the GND controller, explicitly inviting to enter [sic] the Main apron;
the absence of a clear instruction to cross the runway;
the fact that they were tuned on the GND frequency instead of being instructed to switch to the TWR frequency to cross the runway.

The firm belief that they were on the right track did not allow the perception of evident warnings.

Furthermore, continuing on their taxi on TWY R6 along their path, the bar with red lights on was crossed, the Stop sign which was passed by the ICAO pattern B, then the ICAO pattern A markings that were crossed in succession, it is probable that the meaning of all these markings have been interpreted correctly by the crew and fitted with their belief to be on the right path and that they were cleared to enter the runway.

—From the English translation of the official report

That is to say, as they continued to taxi along Romeo 6, they encountered and passed the bar with red lights, a stop sign and two ground markings, all of which signify a runway. It is hard to believe that the pilots could not have seen these signs. The investigators believe that the pilots could not have misinterpreted this information and must have convinced themselves that they were clear to enter the active runway. It was the only route to the main taxiway from Romeo 6. At that moment, the Scandinavian passenger jet was hurtling down the runway for take-off. In the thick fog, the Cessna followed the green lights that led to the runway centre-line, directly into the Scandinavian’s path.

The flight crew of Scandinavian saw the Cessna at the very last moment: there was an unintelligible exclamation recorded in the cockpit and the flight data recorder registered a “large elevator nose-up command” one second before the collision. It was too late.

The Cessna was split into three pieces, scattered across the runway near the intersection. Scandinavian 686 lost its right engine in the collision. The aircraft managed to get airborne for 12 seconds when the left-hand engine ingested debris from the crash and lost thrust. Scandinavian 686 descended abruptly. The pilot reduced engine thrust immediately, deployed engine reverse levers and applied the brakes. The right wingtip dragged through the grass. Despite all of this, the aircraft slid over the runway end and impacted the airport baggage building at a speed of 139 knots (257.6 km/h).

The crew and passengers of the Cessna, the crew and passengers of Scandinavian 686 and four people in the baggage building were killed.

The deep fog wasn’t finished with this disaster yet. With no visibility, it took some time for anyone to understand what had happened.

LX-PRA, the aircraft who was meant to “follow the German” down Romeo 5, realised something was wrong. He asked specifically where the Cessna was.

LX-PRA: We were waiting to exit . . . to see the German coming out, we have not seen him, do you know where he is?

As far as the Ground controller was concerned, he knew where all his aircraft are.

But odd reports were coming in. A number of people on the ground and in other aircraft reported having heard “a number of bangs” and he did not know what that could mean.

A police officer and a customs officer at Gate 5 behind the airport baggage handling area heard an explosion and ran towards it to find a workman on fire. They assisted the man and reported the Police Control Centre, who contacted the fire department. Two fire-fighting vehicles were sent to Gate 5 to deal with an unknown incident.

Meanwhile, the Tower controller was shocked to see that Scandinavian 686 was missing from his radar monitor. He phoned ACC Radar Control who confirmed that the aircraft had not made radio contract and was not showing on radar.

The Fire Station Control Centre received another phone call, stating that there was an aircraft involved in the fire. Four more vehicles were dispatched.

Tower contacted the fire station, which confirmed the fire and stated that fire vehicles had already been dispatched. The fire station did not elaborate, presuming that the Tower already knew that an aircraft was involved. Tower did not even know where the fire was located, let alone that an aircraft had crashed.

Aircraft I-LUBI was lined up on the Pista principale for take-off. Tower asked the aircraft to clear the runway and proceed to the holding bay, to make room for the fire vehicles. Tower then contacted the fire fighting vehicles, which were operating under radio code name VICTOR.

Tower: Victor you may enter the runway, from this moment the runway is clear, you may enter the runway. Make us a report for the whole length. We are missing an aircraft who should have taken off but at the moment it is not in flight so tell us what you may see on the runway, just in case.

Victor 10: To all Victor from Operations Control centre, you can enter the runway as well . . . for the time being it has been closed.

The request to search the runway for a missing aircraft (Scandinavian 686) was never passed on.

Presumably Victor 10 did not take in the implications of “there is an aircraft missing” as they knew about the MD-87. Certainly, Victor 10 dismissed the request to search the runway as non-urgent. Meanwhile, Tower still had not been informed that there was an aircraft involved in the fire.

I-LUBI vacated the Pista principale at TWY R4 and proceeded to the holding bay.

Five minutes after the collision, a doctor from the first aid centre thought to contact Tower to tell them that the Scandinavian Airlines aircraft impacted the baggage building.

In the midst of this chaos, however, it seemed the Ground controller may have had an inkling of what happened. He spoke to another aircraft in an upset voice, saying something about “probably a Scandinavian and a private”. This was the first reference to the possibility of two aircraft involved in the accident.

At the same time, a Tower controller was frantically trying to make contact with the fire engines to find out what had happened. After five minutes of calling, Victor 1 responded.

Tower: OK Victor I want to know the exact position where you are operating. Is the runway clear? Or is it occupied? How many vehicles are on the runway?

Victor: Just in front of the infirmary, let’s say, in the vicinity of the infirmary.

A different Tower controller called the Air traffic services Reporting Office (ARO) and explained that Scandinavian 686 had not been able to take off “for his own problems”, that is, he believed Scandinavian had experienced some sort of technical fault and aborted take off leading to the runway overrun. Tower still had no idea that two aircraft had collided on the Pista principale.

However, again the Ground controller makes a revealing statement to another aircraft that wished to taxi back to the North apron:

Then again, in a separate exchange the same controller referred again to the Cessna as still taxiing on Romeo 5. The Cessna had been burning on the Pista principale for almost 20 minutes now but no one had noticed.

Tower contacted I-LUBI, which had been holding at the bay, giving him clearance to enter the runway and taxi to Romeo 6 to return to the West (GA) apron.

Tower then contacted Victor to ask if they could see two aircraft involved in the fire but received no response.

I-LUBI entered the runway and discovered the burning Cessna at the Romeo 6 junction. I-LUBI immediately contacted Tower, the first to report that there was a fire on the runway.

I-LUBI: I have Romeo 6 in front of me, we vacate the runway the first on the right since there is a fire on the runway . . . Romeo 2.

Tower: BravoIndia copied, then you will hold on Romeo 2 because we have other aircraft on the taxiway.

I-LUBI: Copied, we maintain . . . on Romeo 2, there is fire on the runway, things that are burning, wreckages in flames.

It seems odd that there was no immediate reaction but as far as Tower knew, the runway had been inspected by the fire vehicles. The controller may have assumed that this was debris from Scandinavian 686, part of the technical problem that caused the runway overrun. He certainly had reason to believe that the fire vehicles were already dealing with the issue.

There was, as yet, no real evidence of further on the TWR frequency (yet) but the Ground controller had clearly had time to think through the sequence of events. He spoke to LX-PRA, to try to find out what happened to the Cessna.

Ground: RomeoAlpha, excuse me, we are trying to understand what might have happened, and . . . you were . . . you had been instructed to taxi following the German, right? the DeltaIndiaEchoVictorXray.

LX-PRA: Yes, right, I confirm, but when we started taxi, as we reported on. . . , it was not in sight, therefore we started taxi for Romeo 5, but we have not seen the German.

Then the Tower received a phone call from the Airport handling and service provider, which confirmed that the Cessna had not returned to the parking area.

It was 23 minutes since the initial impact when the Tower controllers finally realised that the Cessna was not where they believed it to be. They followed up on the I-LUBI report.

Tower: Yes this is Tower, listen, I need to talk . . . to talk with one of your vehicles because there is a small aircraft missing, a private plane. Somebody has reported things . . . wreckages in flames, on the runway. Therefore . . . I want to know if earlier on firemen entered the runway, yes or no?

Fire station: earlier on firemen went directly to Gate n. 5, they did not enter the runway, they went through . . .

Fire station: Hmm we do not know . . . maybe they did not see it because of the fog, they went directly to Gate n. 5.

Two officers from the traffic office immediately volunteered to inspect the Pista principale and report.

The fire station also requested vehicles to look for “a missing aircraft on the runway” but Victor 1 responded that no vehicles were free. Tower enquired again regarding the state of the runway and this time Victor 1 confirmed that definitely no fire vehicles had entered the runway since the initial report of a fire.

The traffic officers, operating under callsign DELTA 2, drove down the runway. 26.5 minutes after the collision, they reported what they found.

DELTA 2: TWR from Delta 2 . . . There is an aircraft on the runway . . . ah, what . . . what remains of an aircraft, TWR from Delta 2.

The Cessna, and thus the cause of Scandinavian 686’s overrun, was discovered nearly 27 minutes after the collision.

After analysis of evidence available and information gathered, it can be assumed that the immediate cause for the accident has been the runway incursion in the active runway by the Cessna.

The obvious consideration is that the human factor related action of the Cessna crew, during low visibility conditions, must be weighted against the scenario that allowed the course of events that led to the fatal collision; equally it can be stated that the system in place at Milano Linate airport was not geared to trap misunderstandings, let alone inadequate procedures, blatant human errors and faulty airport layout.

—From the English translation of the official report

The report concluded that the visibility was low, the traffic volume was high, and visual aids were lacking. The crew used the wrong taxiway and entered the runway without clearance but they should have been able to rely on the airfield charts, maps, markings and signs, which was not the case at Milan Linate.

Air Traffic Control gets a few mentions, as well. Their chart should obviously have reference to all markings on the aerodrome, but having failed to identify S4, it was unreasonable for the controller to continue to give clearance when the reported location of the Cessna was meaningless. They did not use standard phraseology and disregarded incorrect readbacks. Finally, the standard of the aerodrome was called into question, with the phrase “in dismal order” used to describe the markings, lights and signs.

The combined effect of these factors, contemporaneously present on the 8th of October 2001 at Milano Linate, have neutralized any possible error corrective action and therefore allowed the accident.

—From the English translation of the official report

The Cessna should not have been flying in the low visibility conditions, that much is clear.

The airport had the flight plan and really should have asked the flight crew to clarify whether they were aware of the visibility conditions and the operational requirements. If the controller was unhappy with the response, he could have contacted the local aviation authority to report the situation. He could have refused clearance to taxi, but this would have been a non-standard response. The responsibility for safe flight rests with the pilot, not with the controller.

However, the airport categorically should have been reporting the correct visibility level and offering the correct assistance to allow for safe conduct across the airfield. The airport’s procedure for declaring visibility was amended a fortnight after the accident so that it no longer relied on pilots reporting problems before responding.

Chapter IV paragraph 4.1 conditions of visibility 3: substitute:

visibility which is not sufficient for the pilots to taxi autonomously . . .

with the words:

RVR visibility of 400 meters or less.

—From the English translation of the official report

This was followed with a new procedure that in visibility of less than 200 metres, only one movement at a time would be allowed, and that, only with the assistance of the FOLLOW-ME. On the morning of the accident, the visibility was well below this level at the GA apron, which shows just how ludicrous it was that the planes were taxiing autonomously around the airfield.

The flight crew knew the visibility was below their minimums. They chose to take unnecessary risks and continued forward despite the fact that they were not sure where they were. There were plenty of clues that things were not as they should be. At the very least, they should have known to never enter the active runway when they were not in contact with the Tower Controllers responsible for it.

Having said that, taking a wrong turn on an airfield is a common event. It should not result in a tragedy and in the end it is the ineffective safeguards at the airport that are critical failures. Bluntly put, the situation at Milan Linate was an accident waiting to happen. The Cessna crew gave a position report for Sierra 4 and at that point, at the very latest, the controller should have stopped them to verify where they were and what they were doing. Instead, the controller told them to continue, disregarding critical information that the plane was not where he thought it was and that the readbacks were not correct. The lack of basic organisation at the airport was further underscored by the chaos of the emergency response. It’s horrifying to consider that if the accident had been survivable, the passengers and crew would have been trapped for twenty minutes in a burning plane on an abandoned runway.

The aftermath of the accident led to the Milan Linate airport finally getting a long overdue overhaul. Although the lion’s share of the blame was heaped onto the Cessna pilots, getting lost in an airfield in itself isn’t a major failure. In the 21st century, it should not require the deaths of 118 people for a commercial airfield to ensure that basic safety guards remain in place, for the protection of everyone.

Using Propellers as an Airbrake

ST. BARTHÉLEMY IS a beautiful Caribbean island, just 22 square kilometres (8½ square miles) with a small airport on the north coast by the harbour. The final approach path takes aircraft just a few metres over a hill directly before descending steeply to the paved runway of 650 metres (2,100 feet) with an overrun onto the beach. St. Barthélemy airfield (and St. Martin, the nearest commercial jet airport for the island) is regularly the subject of viral videos showing aircraft coming in low over the beach or overrunning into the sand. The location allows for stunning aviation photography. The History Channel’s Most Extreme Airports ranked the airfield as the 3rd most dangerous airport in the world.

As any pilot will tell you, much of aviation is routine. Although flying has become more and more automated over the past century, the problem is not new; in WWII they were already quoting the catchphrase: Flying is hours and hours of boredom sprinkled with a few seconds of sheer terror. A risk of the trade is that it becomes easy for flight crew to slip into bad habits and push limits. It should come as no surprise that at an unforgiving airfield like St. Barthélemy, what seems like a simple shortcut can have tragic results.

Surprisingly, despite the challenges of landing at this small airfield, there was not a single public transport accident reported at St. Barthélemy from 1991 to 2001. All of the fifteen reported accidents (including one fatal accident and eleven runway overruns) were general aviation.

F-OGES was a De Havilland DHC-6-300 operated by Caraïbes Air Transport. The DHC-6-300, also known as a Twin Otter, is a high wing aircraft equipped with two turboprops and capacity for twenty passengers. If you take a look at the Twin Otter page on Wikipedia, you’ll find it features a lovely photograph of the aircraft coming in to land at St. Barthélemy. It’s a popular aircraft for island hops.

On the 24th of March, Flight TX 1501 was a scheduled flight carrying seventeen passengers from St. Martin to the smaller island of St. Barthélemy.

The Captain was no newcomer. He’d received his Commercial Pilot’s Licence in 1987 and received his type rating on the DHC-6 aircraft in 1988. He had 9,864 flying hours, 6,400 of those as captain.

St. Barthélemy aerodrome requires a site rating: pilots must have logged at least 2,000 flying hours and do the landing with an accredited flight instructor before being allowed to fly into St. Barthélemy. The Captain received his site rating for St. Barthélemy in 1991, a decade before the fatal crash.

His co-pilot received his Professional Pilot’s Licence in 1999 and his type rating for the DHC-6 in December 2000, just three months before the accident. He had 670 flight hours with only 15 of them on the DHC-6. His manager considered his flying to be “average”. He also had put in some 4,000 hours as a flight engineer. At the end of the month, he was leaving Caraïbes Air Transport to join another operator to return to this role. The week before the accident, he did line flying under supervision in the local area. His instructor performed several take-offs and landings at St. Barthélemy.

The two men flew together for the first time on the 22nd of March. The day before the accident, two passengers on the scheduled flight to St. Martin reported the Captain remonstrated with the co-pilot at take-off and again after a hard landing at St. Martin, in a “notably reproachful tone”.

On the 24th of March, Flight TX-1501 was an hour delayed as a result of passengers arriving late from a connecting flight. When they were finally able to start-up, an issue with the rear cargo hold door held them up for a further ten minutes. The mechanic who fixed the door reported a stormy conversation between the co-pilot and the Captain after the repair was complete. The Captain sent a message to the Caraïbes Air supervisor to say he would open the door himself after landing, implying that he felt the co-pilot had done something wrong.

F-OGES finally departed St. Martin for the nineteen-mile trip to St. Barthélemy, their fifth flight to the island that day. This was the last scheduled flight of the day, after which the Captain would ferry the aircraft back to St. Martin and participate in a football match. He was going to be late.

They cruised towards St. Barthélemy at 1,500 feet and as they passed abeam of the island of Fourchue, the co-pilot contacted St. Barthélemy Information frequency. A few minutes later, he reported passing the Pain de Sucre reporting point for final approach to runway 10. That was the last communication heard from flight TX-1501 inbound to St. Barthélemy.

The Aerodrome Flight Information Service (AFIS) at St. Barthélemy is very basic. There are no radio-navigation aids. There are no radar recordings. There’s no view of aircraft on approach until the last minute when they have passed over the La Tourmente pass. On the day of the accident, the radio communications recorder in the tower had been out of order for a year and a half. The agent said that when F-OGES reported Pain de Sucre, he gave them the latest wind and told them the runway was clear. Everything was normal, he said. Then he looked towards the pass and saw the aircraft turning left, belly visible, at low altitude. He immediately invoked the emergency procedure.

The aircraft never recovered from the steep left bank. It crashed next to a house on the Corossol road, about six hundred metres (less than 2,000 feet) from the threshold of runway 10. All of the occupants and one person on the ground were killed in the violent impact.

The investigators arrived the following day and soon found they had a problem. The St. Barthélemy AFIS had no recordings of any kind and the investigators discovered that the aircraft’s age and low take-off weight meant it was not required to be fitted with flight recorders. F-OGES had neither a cockpit voice recorder nor a flight data recorder. The only hard data that the investigators had to work with was the wreckage, which was spread over an area of nine hundred square metres (ten thousand square feet).

The initial investigation was able to dismiss a number of possibilities. The weight and balance sheet was erroneous; however the aircraft was within the weight and balance limits set by the manufacturer. There were no deferred defects logged, in fact, the only issue in the technical log was the issue with the cargo hold door, which was found still attached to the aircraft by the hinges. There were no relevant wind or other weather phenomena reported. There were no traces of a bird strike. Both turboprops were operating and producing significant power at the time of impact. There was no evidence of a structural break-up in flight. The autopsies revealed no medical issues. With no flight data recordings, it seemed impossible to uncover the mystery of the crash.

There was one crucial find in the wreckage: two video cameras. One was so damaged by the impact and subsequent fire that it could not be played back. The other, though, had footage of the flight. The film started during the initial climb out from St. Martin, with views from the cruise and finally showing the approach to St. Barthélemy, ending just one minute before the crash. The final scene, a horizon with veiled clouds through the right side, shows that the aircraft was not turning.

The investigators analysed the film in order to understand the precise position and attitude of F-OGES that day, as well as the operation of the propellers and the engines. Once they determined what seat the footage was filmed from, they recreated the video on an aircraft of the same type to gain more information. Over the course of six commercial flights, they were able to prove that the engines were running normally from take-off up to the last image, with an increase in the propeller speed at the beginning of the descent towards the aerodrome.

The videos also allowed investigators to confirm the exact positioning and height of the aircraft, including the fact that it was slightly right of the approach path.

The investigation team also spoke to the people in the local area who saw and heard the aircraft before the accident.

The people living west of the La Tourmente pass heard a loud engine noise and saw F-OGES with its “nose up” go into a left turn. A Caraïbes Air Transport flight instructor, with 1,500 flying hours on the aircraft, watched from his terrace as it came in.

On the day of the accident, he saw F-OGES arriving on a track which seemed normal to him at the beginning but a bit low on short final compared to normal practice. For him, this track could be explained by downdraft winds which the aircraft can be subjected to at that place. He heard thrust being increased but at a much higher rate than for a simple correction, sufficient on approach. The aircraft then adopted a nose up attitude then turned slowly to the left before banking at about 60° to the left. The left wing then stalled and the aircraft dived towards the ground just before the La Tourmente pass.

—From the English translation of the official report

Between the film footage and the eyewitnesses, the team were able to recreate the final phase of flight. However, this did not offer any answers as to why F-OGES crashed the way it did. The video did not show any malfunctions or anomalies during the recorded duration of the flight. Sudden incapacitation in flight could not have happened simultaneously and suddenly to both pilots with no external reason. The witness descriptions proved that it was neither a sudden change in weight and balance nor a passenger intervention in the cockpit, both of which would cause an erratic track. The description of a sudden loud engine noise before the crash could mean that the aircraft had stalled and was in a recovery; however it seemed unlikely that the experienced pilots would fail to notice the aircraft’s speed decay below approach speed on short final.

A Caraïbes Air Transport pilot said that he’d spoken to the Captain of F-OGES after his hard landing at St. Barthélemy that morning, saying that he recommended an initial approach at 1,500 feet and then keeping the descent path until touchdown. The Captain responded that he preferred to take a lower approach path.

Then a breakthrough came when the investigators spoke to the Caraïbes Air Transport mechanic who was on F-OGES for the earlier flight to St. Barthélemy. He had a front row seat in the cabin and told investigators that the landing was quite hard. He said he joked with the Captain about the hard landing, and the Captain responded that he still didn’t have a feel for the aircraft, as he had only been flying it again for two days. The Captain then told the mechanic that he had previously used “beta” on approach to slow down and he planned to try that method again.

A propeller in alpha mode governs the RPM using the angle of the blade. In beta or reverse beta, the angle of the propeller blades is such that the propellers direct their thrust forward instead of back, effectively a reverse thrust. This is generally used in order to slow the aircraft down on the ground or in some instances to cool the engine on descent. A propeller-driven seaplane, for example, has no brakes and is dependent on changing the angle of the propellers in order to slow or stop on water. In flight, the effects can be unpredictable and De Havilland states that beta mode and reverse beta mode should only be used when the plane is on the ground. The power lever assembly has a mechanical stop that prevents the pilot from accidentally entering beta mode and passing below flight idle.

The mechanic was shocked that the Captain would consider such a thing. He immediately responded that beta mode was prohibited during flight. The Captain snapped back that he was not going to teach him how to fly the plane.

The Caraïbes Air Transport manager confirmed that he believed that certain pilots used “beta range” for steep approaches, despite the manufacturer’s ban.

A retired pilot from the airline also admitted that sometimes he’d used “the beta range” to keep the airspeed low while on the steep approach path to St. Barthélemy, even though he knew it was prohibited.

A Caraïbes Air Transport DHC-6 Captain stated that one of the problems of the DHC-6 was the fact that, to follow steep approach paths like that of Saint-Barthélemy, pilots quickly find themselves with the control column fully forward, even when the power is fully reduced. The problem is even more critical when the aircraft CG is to the aft. This is one of the reasons why some pilots use the “beta range” during the approach. In this case, it is possible to pass under the path with a low airspeed. If the power levers are mistakenly pulled beyond the “beta range”, the propellers pass into “reverse” mode in a more or less symmetrical way. It is then necessary to increase power and a possible propeller unfeathering asymmetry can end up in a loss of control.

—From the English translation of the official report

The scenario began to come clear. The Captain had made clear his decision to use beta mode (by which he likely meant reverse beta mode) as he was having difficulty coming into St. Barthélemy. Selecting reverse beta range for the propellers would reduce the airspeed and allow him to regain the descent path. The propeller effectively acts as a powerful brake.

It was the last landing of the day and a go-around would add extra time to the already late flight. The co-pilot was inexperienced and had already been told off by the captain, so he was extremely unlikely to interfere. Once the propeller pitch offered reversed thrust, the airspeed dropped right down, as intended.

Now, the Captain needed to shove the levers back to their normal-use range. This would increase the thrust, which explains the change in engine noise that witnesses described. If the levers weren’t moved perfectly in line with each other, it would cause asymmetry between the engines. And that’s what the investigation concluded: he shoved the levers back into the correct position for in-flight but the movement wasn’t perfectly aligned. This led to the violent yaw movement seen as a sharp roll to the left.

That close to the ground, the Captain had no chance to regain control of the aircraft.

As a result of the impact, it was not possible to determine the pitch of the propellers or the position of the levers. The lack of flight recorders and radar track made it impossible to prove categorically what happened, but this is by far the most likely explanation.

3.2 Probable Causes

The accident appears to result from the Captain’s use of the propellers in the reverse beta range, to improve control of his track on short final. A strong thrust asymmetry at the moment when coming out of the reverse beta range would have caused the loss of yaw control, then roll control of the aircraft.

—From the English translation of the official report

The results of this investigation pointed to a company culture that allowed for shortcuts and risks: the captain was out of date, the management wasn’t paying attention, multiple pilots referring to the use of beta mode in the air, the lack of support for the captain’s hard landing when he stated directly that he was struggling to “nail the landing” at the airfield. The Captain was in a bad mood. The flight was already running an hour late and he was in a hurry to get home. He used the side effect of a propeller setting that was meant to be used only on the ground. His first officer was an inexperienced first officer who had already been told off once that day, thus unlikely to argue.

Combined with the challenge of flying into St. Barthelémy, it starts to look inevitable that something was going to go wrong. The critical factor is not how to stop pilots taking shortcuts, but rather how to keep those shortcuts from becoming standard and, most importantly, how to stop them from becoming fatal. In this instance, we have a clear failure of the airline’s safety culture.

As a result of this specific accident, La Tourmente pass has been lowered by six metres (20 feet) in order to allow for a safer approach to runway 10. A new tower has been built and the AFIS agents now have access to updated radio equipment. However, how long aircraft should be allowed to run commercially without compliance to recording requirements (which would have made the sequence of events trivial to investigate) remains an open question.

Nose Down into the Runway

THE AIRBUS 320 WAS a breakthrough, the first commercial aircraft to use digital fly-by-wire and a sidestick control. The controls in an aircraft are usually directly connected to the parts of the plane but with digital fly-by-wire the controls are disconnected, so the movement of levers and the stick are sent as data to the computers, which decide what to do with the movement. The computers consider the flight parameters as well as the pilot inputs to determine the changes required in the flight control surfaces.

Compared to traditional controls, the digital fly-by-wire system is lighter and more cost-efficient to manufacture. More importantly, the Airbus fly-by-wire system provides flight envelope protection. The pilot at the controls is not directly controlling the flight control surfaces of the aircraft. Instead, his input is sent to the flight-control computers, which interpret his actions and control the aircraft accordingly. Abrupt movements that would put the aircraft outside of its ability to fly safely are dampened, which prevents the pilot from exceeding structural and aerodynamic limits of the aircraft. For example, if the pilot pitches the aircraft nose up, the flight control computer will ensure that the aircraft does not pitch up beyond a safe value. The intent is to allow the pilot the freedom to pull back on the controls without worrying about whether he will put the plane into a stall, as the flight computer will ensure the climb is at the maximum safe rate.

On the 7th of February, EC-HKJ, an Airbus A-320-B operated by Iberia, departed Barcelona as Flight IB-1456—a scheduled domestic night flight to Bilbao. The A320 held 136 passengers, 3 flight crew and 4 flight attendants. The expected flight time was 53 minutes. The aircraft was new, manufactured in 2000 and with a total flight time of 1,149 hours. The last (and only) annual inspection had been on leaving the production line.

The pilot flying was a commercial pilot with 423 hours. He completed his type rating course for the Airbus A-320 just over a month before. He was flying under the supervision of the Captain, who had spent over 10,000 hours flying, almost ten times the flight time of the aircraft that he was in charge of. The skies were fairly clear at Bilbao, with scattered clouds and a 10-knot wind gusting up to 25 knots.

As the Iberia flight passed over Pamplona, cruising at 15,000 feet, the flight crew were warned of possible light turbulence. 25 nautical miles out from Bilbao at 7,500 feet, the aircraft began to experience strong turbulence.

Bilbao Airport is close to the coast and is surrounded by mountains. South of the airport, there are peaks up to 4,839 feet which produce turbulence when the wind comes from the south. Eddies and whirlwinds are a hazard in stable atmospheric conditions.

8 minutes prior to landing, as they descended through 6,000 feet, the flight crew expressed surprise at the strength of the turbulence and commented on the 55-knot winds that they were facing.

The controller also discussed the wind conditions with Vitoria tower, specifically that although the wind at ground level seemed to be light, at higher levels it was “quite bad”, with low to moderate turbulence and severe wind shear.

Bilbao Tower cleared IB-1456 to land on Runway 30, informing them of current winds of 8 to 15 kt at 240°, with light turbulence. The crew continued their approach at a stable ground speed but the gusting winds meant that the calibrated airspeed was fluctuating by +/- 6 knots. The aircraft appeared to be speeding up and slowing down as the wind gusted past.

Five minutes before landing, the overspeed warning sounded, caused by the strong winds gusting both horizontally and vertically.

At the time, Iberia had the following warning regarding Bilbao airport in their operations manual, quoted in the accident report:

“1. Caution:

“When there is wind between 160° and 230° higher than 15 kt, expect turbulence and wind-shear during approach and landing.

“It is recommended that, when the intensity is higher than 20 kt and there are no reasonably positive pilot reports on conditions, no operations are to be carried out at this airport.”

—From the English translation of the official report

The current wind on the ground was just below this level; however the wind that the crew were experiencing as they came down to land appeared to be much stronger. The Terminal Aerodrome Forecast (TAF) released at 19:04 also warned of a 30% probability of winds up to 25 knots with gusts up to 40 knots.

However, both the current meteorological report and the information from Tower advertised only weather of lower intensity with winds under 15 knots, well within the limits of a safe landing. The plane shook with turbulence and the overspeed warnings continued as the crew continued into Bilbao.

The crew disconnected the autopilot as they descended through 400 feet. At a decision height of 247 feet, conditions were visual and IB-1456 continued the approach to land.

Runway 30 is 2,600 metres (8,530 feet) long with a stopway at the end of the runway with a glide slope lightly steeper than standard at 3.35°. The aircraft descended on the glide slope. One minute before touchdown, tower informed the crew that the wind conditions were 240° 8 knots.

At 200 feet, they flew into a tailwind. Before they reached 100 feet, a sudden up draft hit the plane, registering as a 1.15 g acceleration. This is not a lot of g-force, unless you are trying to land an Airbus. At just a hundred feet over the threshold, the sudden extra speed from the tailwind followed by the strong updraft makes for a tricky landing.

The Pilot Flying pushed his sidestick forward to counter the draft but the gusting hadn’t stopped. Five seconds before the touchdown, a down draft struck. The Pilot Flying and the Captain both pulled back on their sidesticks. The two sidesticks work independently from each other and if both pilots use their sidesticks at the same time, an alarm sounds and the flight control system considers the algebraic addition of both sidestick inputs.

The dual input alarm sounded. Either pilot could have (and should have) cancelled the other pilot’s sidestick input by pressing the override button but neither did. They both continued to pull back. The combination of the dual input exceeded a pitch-up rate of 10°.

The angle of attack increase, the high approach speed and the combined input of both sticks was interpreted by the computer as dangerous. The flight control system activated the Angle of Attack (AOA) protection.

The Angle of Attack is a critical aspect of aircraft performance and handling. An aircraft wing has a limited range of Angles of Attack that allow for efficient flight. If the Angle of Attack gets too high, the wing loses lift and the aircraft will stall. The aircraft becomes hard to control and is at risk of entering a spin.

The Airbus A320 flight envelope protection includes sophisticated Angle of Attack analyses to prevent the aircraft from entering a stall when overly forceful manoeuvres are requested. In an Airbus, a pilot cannot suddenly pitch the plane’s nose up and risk stalling the plane; the elevator deflection is limited. The pilot does not have to concern himself with precise movements because he knows the flight computer will use the maximum safe value. The aircraft is protected from abrupt changes in configuration by the pilot.

This Angle of Attack protection is done using an algorithm which defines a safe value for the angle of attack and a maximum value for the current circumstances. The algorithm predicts the change made to the aircraft’s attitude, based on the current angle of attack and the position of the sidestick. The AOA protection is activated when the sidestick is pulled fully backwards and there is a very high angle of attack or a fast-increasing angle of attack. Once AOA protection has been activated, the sidestick input is reduced. The flight control system ensures that the angle of attack remains between the safe value and the maximum value. The aircraft is prohibited from exceeding a safe angle of attack.

On this day in Bilbao, the unexpected increase in the angle of attack, combined with the high approach speed and the combined input of both sticks was interpreted by the computer as dangerous. The flight control system activated the AOA protection. The aircraft was protecting itself against pilot error. But the pilots knew exactly what they were doing.

Once the AOA protection activated, the flight control system limited the possible angle of attack. Pulling back violently on the sidesticks had no effect—especially not with both pilots pulling at once.

In order to land, the pilots have to be able to raise the nose. An aircraft doesn’t touch down nose-first. When landing, the aircraft flares: the pilot reduces the descent rate and pitches the nose up and the aircraft sinks gently to the ground, landing firmly on the landing gear.

The Ground Proximity Warning System sounded twice: SINK RATE. SINK RATE. The AOA protection made it impossible to flare. The Captain took control from his first officer and attempted to break off the landing. He put full power on, attempting a touch and go. His only hope: get the aircraft back into the air where they could work out what was going wrong. Throughout this, both pilots continued to desperately pull back on the the stick as they were still trying to regain control of the aircraft’s pitch.

As a result, the AOA protection remained active. They could not pitch the plane up in order to land safely. They could not go around.

There’s a further aspect to the AOA protection. In order to avoid oscillations (known as phugoid movements), the AOA protection will limit the possible angle of attack even further if the airspeed is diminishing, exactly as it should be when landing. The pilots needed to slow down and pull the nose up. However, the flight control system will actually pitch the aircraft nose down if the airspeed decreases too suddenly.

For our pilots in Bilbao, things were about to get even worse. Four seconds in, the engines finally had enough power to recover straight and level flight, which would allow them to fly straight over the runway.

That’s when the tailwind struck. The aircraft was just 80 feet over the ground when the calibrated air speed dropped dramatically. This triggered the protection against phugoid movements in a high angle of attack scenario.

The pilots were still frantically pulling back on their sticks. Instead, the flight control system pushed the nose down.

They were just a few feet over the runway when the nose pitched down. The plane hit the ground hard, undergoing g-force pressure of 4.75 g—a normal landing is just above 1 g. The nose gear tire marks on the runway lasted for just 10.5 metres (341/2 feet) before turning into deep metal scrapes.

The AOA protection de-activated after the aircraft hit the runway and the nose finally lifted.

The Captain continued the landing (to be fair, he had no choice) and slowed the aircraft along 1,100 metres of the runway. The nose dipped down again, scraping the engine nacelles along the pavement. The nose leg, or what remained of it, cut deep grooves into the runway. The aircraft veered violently to the left as the four main gear tires burst.

The Captain ordered an immediate evacuation using all exit doors and slides. The passengers panicked, injuring twenty-four passengers and one cabin crew member in the resulting stampede. Seven trampled passengers were taken to hospital.

3.2. Causes

The cause of the accident was the activation of the angle of attack protection system which, under a particular combination of vertical gusts and windshear and the simultaneous actions of both crew members on the sidesticks, not considered in the design, prevented the aeroplane from pitching up and flaring during the landing.

—From the English translation of the official report

As a result of this accident, Airbus Industrie modified the logic for AOA protection in case of turbulent conditions, inhibiting the activation of the AOA protection as triggered by wind gusts and deactivating the protection in flight at low height.

The National Meteorological Institute began a study of the meteorological phenomena of Bilbao, researching the development of turbulence, gusts and windshear in the vicinity of the airport.

Snow in the Engine

HUMAN MEMORY IS FALLIBLE, especially in times of stress. Flight crew have manuals and printed checklists to hand so that they can deal with a wide variety of issues and remain confident that no critical items are forgotten. In this tragic accident, seemingly trivial items in the operations manual led to a fatal situation.

A double engine failure is a very rare occurrence. For both engines to fail at the same time, it can’t simply be a mechanical fault. There are two main causes of double engine failure: severe fuel mismanagement and ingestion of foreign matter.

When G-BNMT departed from Edinburgh on the 27th of February, they had plenty of fuel. They were flying in clear weather. And yet, both engines failed within a third of a second of each other.

Double engine failure is so unexpected that at the time of the accident, the operating manual for the SD3-60 twin turboprop had no procedure for a correct response. And as a result, it took the lives of two competent crew who were running a Royal Mail service from Edinburgh to Belfast.

The sequence of events that led to the fatal crash started at the very beginning of the day, at three minutes after midnight.

G-BNMT, a Shorts Brothers SD3-60 Variant 100 operated by Loganair, arrived at Edinburgh airport. G-BNMT was a high wing monoplane with retractable landing gear and two turboprop engines.

It was a cold winter night when the aircraft arrived at Edinburgh just after midnight. The first crew taxied the aircraft to the stand, refuelled it and left the airport without securing the aircraft, as it was scheduled for a further flight.

The second crew arrived less than half an hour later for the next flight scheduled from Edinburgh to Belfast for 00:40. It was freezing cold. G-BNMT needed de-icing in order to fly but so did every other aircraft on the field. The flight crew were told it would take a few hours to get to them. They waited in the crew room.

Just after 2am, Edinburgh Airport closed as a result of severe weather conditions, “of a nature not routinely experienced in the UK.” The flight was cancelled.

The second crew stayed on site in the crew room, hoping that the weather might clear. At 6am, they gave up. They returned to the aircraft, fitted propeller straps to each engine, put the pitot head covers on and went home.

The SD3-60 turbo-prop has air intake blanks (“bungs”), which are fitted into the engine intakes to prevent debris, dust and snow from entering the engine intake area. These intake bungs were routinely fitted by the engineers when the aircraft stopped overnight at the operational bases (Glasgow, Kirkwall and Inverness). At Edinburgh, there was no engineering personnel and no engine intake bungs.

The Operations Manual stated that Engine covers and bungs should be fitted as available. They were not available at Edinburgh that night and thus not fitted.

Meanwhile, in Glasgow, the accident crew arrived at 8am for a planned flight to Islay at 09:10, but the flight was cancelled as a result of the weather. The crew was rescheduled to fly G-BNMT from Edinburgh to Belfast—the plane whose midnight flight had been cancelled in the early hours as the weather deteriorated.

The snow and weather made it impossible to get to Edinburgh by road. Edinburgh Airport finally re-opened at 11:30 and the crew hitched a ride on another flight to pick up G-BNMT.

By the time the accident crew arrived at Edinburgh, the weather was much improved and the Captain did not feel that the aircraft required de-icing. Very little evidence remained of the wind and snow conditions that the aircraft had been exposed to.

At 15:03 they requested clearance to start, which was given. However, at 15:12, the crew advised ATC that they were shutting down due to a technical problem. The right engine driven generator would not come on line and the crew requested engineering assistance from the company.

An engineer transiting through Edinburgh tested the connections and asked the crew to run both engines for about 15 minutes. He then returned the connections to their original positions and the crew ran the engines again for 15 minutes. The original fault could not be reproduced.

The Commander asked the engineer to check the oil and confirm that the upper surfaces of G-BNMT were free from ice and snow.

The engineer found only a small slush deposit on the windscreens, which he cleared.

The crew restarted the engines and remained on the stand with engines running for about another 20 minutes.

At 17:10 the First Officer requested taxi clearance and the aircraft taxied to depart from Runway 06. The crew completed their “first flight of the day engine checks”, including an autofeather test. This test feathers the propeller—that is, rotates the propeller blades, aligning them with the direction of the plane—and the anti-ice vanes are driven to the full anti-ice position.

The Operations Manual states that the engine ignition should be set to EMERGENCY setting when taking off on runways contaminated by snow or slush. In the EMERGENCY position, the ignition system operates continuously, which allows the engine to automatically relight if there is an engine flameout caused by ingestion of snow or slush during the take-off run.

There was still some slush residue on the taxiways but not on the runway. Conditions were “WET”—that is, surface soaked but with no significant patches of standing water. Thus, the engine ignition systems were set to NORMAL not EMERGENCY.

After take-off the crew retracted the landing gear and then released and retracted it again, to ensure that it was free of snow and slush. After this, the Commander called for after take-off checks to be completed. They were in clear weather but expected to fly into cloud. The Commander asked the First Officer to select the anti-icing systems ON.

Edinburgh Tower asked G-BNMT to change frequency to Scottish Control. The First Officer acknowledged the frequency change and the Commander selected the new frequency while the first officer selected the anti-icing systems to ON. The aircraft was at 2,200 feet above mean sea level.

The first engine flamed out. The second engine failed 0.37 seconds afterwards. The aircraft was experiencing a double-engine failure.

The most likely cause for a double engine failure in this scenario is foreign objects ingested by both engines at the same time, for example hail, ash or birds.

If this happens, it is often possible to rapidly restart the engines as the foreign objects clear. However, there was no procedure for an emergency engine relight within the Operations Manual. In fact, there were no procedures at all in either the Operations Manual or the Aircraft Flight Manual for a forced landing without power. The possibility of a double engine failure was simply not acknowledged.

The Commander declared that it was a double engine failure and initiated a descent while reducing the airspeed and turning towards the coastline.

Meanwhile, the First Officer notified Scottish Control. It was their first call on that frequency.

G-BNMT: MAYDAY MAYDAY MAYDAY THIS IS LOGAN SIX SEVEN ZERO ALPHA WE’VE HAD A DOUBLE ENGINE FAILURE REPEAT A DOUBLE ENGINE FAILURE.

Scottish Control: Roger er Loganair six seven zero alpha roger your mayday. Turn er left on to heading of er two five zero. The airfield is three miles to the northeast of your present position.

The message was truncated at the last syllable. The air traffic controllers received no further communications from the aircraft.

Inside the cockpit, the Ground Proximity Warning Sensor alerts changed to a warning of TERRAIN, TERRAIN, followed by a continuous warning of WHOOP, WHOOP, PULL UP. The Commander increased the pitch attitude of the aircraft and correspondingly reduced speed. The accident investigation came to the conclusion that the commander probably achieved the best possible speed and attitude combination for the ditching.

The final transmission from the aircraft, advising of a ditching, was never received. In the cockpit, the CVR recorded one further warning of TERRAIN, TERRAIN and then the recording ceased.

The training that they’d received for a ditching could not have helped them: the manuals had no proviso for escaping from a submerged aircraft. The Operations Manual specifies that it is essential that the aircraft alights on the water with all exits closed. The crew’s only possible escape was the overhead hatch, which would have been difficult or impossible to open underwater.

The aircraft, or what remained of it, came to rest on the sea bottom, trapping the crew within. It is unlikely that the crew could have survived more than a few minutes in the cold seawater.

The time from the first engine flame out to the impact on the water was 62 seconds.

When they found the aircraft, the tide had receded. The flight deck was destroyed and the aircraft was firmly embedded in the sand. On initial investigation, there was no evidence of any technical failure or defect that could account for the double engine failure. At the same time, there was no crew action that could explain why both engines lost power at almost exactly the same time.

Through much testing, they were able to reconstruct the sequence of events that caused the flameouts.

G-BNMT arrived at Edinburgh at midnight and was parked facing into wind until its taxi to the runway at 17:10.

That night at Edinburgh, there was a sustained strong northeasterly wind, up to 43 knots, and light to moderate snow fall until 09:52 that morning, conditions strong enough that, as per the Maintenance Manual, the bungs must be fitted.

In the Maintenance Manual, it said that the bungs must be fitted in severe weather condition, which was certainly the case that night in Edinburgh. However, the Operations Manual made no mention of this, and stated only that the engine intake bungs must be fitted if the aircraft was parked for any length of time, for example an overnight stay. The pilots would have referenced the Operations Manual. G-BNMT was never meant to stay at Edinburgh and so no one reported the lack of bungs.

For eight hours, it was snowing and the wind was blowing hard. The temperature remained between freezing and +1°C. The snow entered the plenum chambers of the engine where the large snowflakes would easily have flowed upwards in the local airflow, landing on the top and sides of the engine.

When the plane was first parked, the engine casings would have been warm enough to melt the snowflakes but the storm continued as the engines cooled and the wet snow froze onto the casings. Within this now frozen area, there were plenty of surfaces where the snow could accumulate. Fresh snow rapidly built up on the frozen snow and by morning, it probably occupied “a significant proportion of the available volume within the plenum chambers.”

Each time the engines were run, they would have warmed rapidly. Snow, slush and water would have fallen to the bottom of the plenum chambers, resting at the bypass doors of the anti-ice vanes. As the engines continued to run, the intake air drawn in ranged from frozen to +2°C, cold enough to refreeze the slushy deposits. This kept the material in place.

At first sight, the snow/slush lying against or adjacent to the bypass doors would be expected to melt during the periods of idleness of the hot engines. In practice, however, the continuous feed of cold air produced by the wind and temperature drop created by its flow over the melting ice/slush would have ensured that the warm engine had little or no chance to further melt the slushy or possibly re-frozen material.

—From the official report

But when the accident crew arrived at Edinburgh, most of the snow and slush had been blown away or melted. The captain did not know the extent of the weather that the aircraft had been exposed to. By the time the final crew did their pre-flight checks, there was no snow or ice to be seen on the aircraft frame. The engineer found only a small amount of slush deposited in the window.

Checking the engine intakes is not a part of the pre-flight procedure and in order to do so, the crew would have needed steps to see up there. Even if they had climbed up to check inside the intake cowl area, the snow/slush in the plenum chambers would not have been visible. The Air Accident Investigation Branch conducted tests and concluded that the slush/snow could only be spotted with the use of mirrors or by actually removing the engine cowlings.

The forward intake vane and the aft vane shown above are part of the anti-ice system, which was activated shortly before the flameouts. The anti-icing system on the aircraft is turned on through a series of switches on the panel. The final pair of switches that were activated set the anti-icing vanes into motion.

The forward vane is a deflector, hinged at its forward surface. The aft vane is a bypass door, hinged along the upper edge. The vanes were operated at least once on the ground and then again as a part of the autofeather tests. But as the vanes returned to their starting position, the airflow was such that the snow/slush slid back towards the bypass doors. The engines were idle and the much lower compressor demand meant that very little of the snow/slush/water was ingested by the engines.

The original crew prepared G-BNMT ready for an immediate flight, leaving it parked, facing into wind, for much longer than intended. The final flight crew may not have known of the snowstorm that had blown into the plane during the previous night and certainly could not have known that the plenum chambers had filled with snow and slush. All pre-flight checks and procedures were carried out as normal.

Once in the climb, the accumulated snow, ice and slush was disturbed by the movement of the anti-ice vanes and was ingested by the engines on climb power, causing the flameouts.

The AAIB cited six causal factors, starting with the lack of a practical procedure regarding the installation of intake bungs in adverse weather conditions. The next few factors refer to the snow entering the engine intake system as a direct result of unprotected engine intakes facing directly into strong winds. The large volumes of snow, ice or slush melted, re-froze and continued to rest in the chambers. Finally, the movement of the intake anti-icing vanes and the presence of the snow altered the engine intake airflow conditions and resulted in the near simultaneous flameout of both engines.

The final causal factor cited is that the standard operating procedure of selecting both intake anti-ice vane switches simultaneously, rather than sequentially with a time interval, eliminated a valuable means of protection against a simultaneous double engine flameout.

Modern training for adverse weather conditions now includes turning the anti-ice systems on one at a time, acknowledging the risk of ice being ingested as a result. Standard operating procedure has changed as a direct result of this accident.

Can You See What I See?

ASPEN AIRPORT (ASE, also known as Sardy Field) is known among pilots as one of the most challenging approaches in the US. The single runway is at an elevation of 7,820 feet (2,383 metres) and surrounded by mountains. The minimum decision altitude (MDA) is 10,200 feet and incoming aircraft must make staggered steep descents to safely reach the threshold.

On the 29th of March in 2001 a private jet, a Gulfstream III, crashed into sloping terrain on final approach, killing three crew members and fifteen passengers on impact.

The Captain and the First Officer were both properly certificated and qualified with thousands of hours of experience. Neither was fatigued. The aircraft was properly certified and equipped. The navigational aids and airport lighting systems were all functioning as intended.

And yet the $10 million Gulfstream jet crashed 2,400 feet (730 metres) short of the runway threshold, killing all the occupants.

On the morning of Thursday the 29th, the Captain and his First Officer arrived at Burbank airport around lunchtime for a charter flight taking fifteen passengers to a dinner party in Aspen. Note: All times are given in Mountain Standard Time, which was the local time in Aspen.

As a part of the pre-flight planning, the First Officer discovered that the approach procedure at Aspen had been updated two days previous. On the 27th of March, two days before the flight, the FAA had released a Notice to Airmen (NOTAM) stating that circling was not authorised at night, as the FAA had concluded that instrument approaches into the airfield in the dark were dangerous. There is no straight-in approach to Aspen. The high terrain on all sides means that the glide slope would be too steep for a stable approach in instrument conditions.

The Captain expected a visual approach and stated early on that they would only try the approach once. If they weren’t able to get in on the first attempt, they would divert to their alternate airport in Rifle, Colorado. The Gulfstream departed Burbank with three crew at 15:38 for the eleven-minute flight to Los Angeles International where they planned to pick up their passengers and take them to Aspen. However, the passengers were late.

While waiting at LAX, the Captain discussed Aspen’s nighttime landing restriction with another pilot and the First Officer. Aspen ASE required aircraft to land “no later than 30 minutes after sunset” to comply with local noise restriction legislation. Sunset on the 29th was at 18:28, so the aircraft needed to land by 18:58 to comply with the restriction. It’s not known whether the First Officer mentioned the NOTAM; however it is clear that the flight crew planned be on the ground before night fell.

The Gulfstream eventually departed at 17:11, forty-one minutes later than the First Officer had scheduled. The flight was expected to be one hour thirty-five minutes, for an estimated arrival at 18:46: twelve minutes before the curfew. The Cockpit Voice Recorder recovered from the accident makes it clear that the flight crew were keeping tabs on the time.

18:37:04 The First Officer calls for an approach briefing. The Captain responds, “We’re . . . probably gonna make it a visual . . . if we don’t get the airport over here we’ll go ahead and shoot that approach . . . We’re not going to have a bunch of extra gas so we only get to shoot it once and then we’re going to Rifle.”

18:44:22 The Gulfstream changes frequency to ASE Approach Control and makes contact with the controller.

18:44:43 A Canadair Challenger 600 contacts the controller to request another approach. The approach controller clears the aircraft to continue on the missed approach procedure.

18:45:00 First Officer states, “I hope he’s doing practice approaches.”

A missed approach is initiated when the approach is unstabilised or unsafe and cannot be completed to landing. The approach plates for an airport include a decision height or missed approach point, by which time the runway must be in sight. If it isn’t in sight by that point, or there is any other reason that a safe landing might not be possible, the missed approach procedure is initiated. The aircraft will climb away on a specific heading and, once the procedure is completed, can initiate another approach attempt at the same airport or divert to an alternate airport, depending on the conditions and reasons for the missed approach.

A missed approach is a demanding situation and often pilots will deliberately request the missed approach procedure as a part of their training. This was what the First Officer was hoping for, because if it wasn’t a practice missed approach, then it was likely that visibility at the airport was uncomfortably close to minimums.

At the time, the cloud tops were at 16,000 feet and the aircraft was in and out of cloud after descending past this level.

About 3 seconds later, the captain asked the controller whether the pilot of N527JA was practicing or had actually missed the approach. The controller replied that the pilot had missed the approach and indicated that he had seen the airplane at 10,400 feet. The controller also informed the captain that two other airplanes were on approach to ASE.

—From the official report

18:45:45 The Captain says, “Where’s that . . . highway? Can we get down in there?”

18:45:56 The Captain asks, “Can you see?” The First Officer replies with, “I’m looking, I’m looking. . . . no.”

18:46:26 The Captain says, “I got it,” followed by “Can’t really see up there, can ya?” The First Officer replied with “Nope, not really. I see a river but I don’t see anything else.”

18:47:19 The First Officer says, “I see . . . some towns over here and the highway’s leading that way but I’m not sure.”

18:47:30 The Approach controller makes a general broadcast that the pilot of a Cessna Citation saw the airport at 10,400 feet, 200 feet above the minimum decision altitude, and was making a straight-in approach. The First Officer says, “Ah, that’s good.”

18:47:41 The Captain tells the controller, “I can almost see up the canyon from here but I don’t know the terrain well enough or I’d take the visual.”

Aspen has a VHF omnidirectional range / distance measuring equipment (VOR/DME) instrument approach which does not include straight-in minimums because the descent would be too steep. The instrument approach is a non-precision approach. After you pass the Red Table VOR (the initial approach fix), you reduce your altitude at specific intervals (called step-downs), which ensure that you are clear of the terrain. As you approach the airfield, you should have the runway (and surrounding terrain) in sight and be able to finish your approach visually.

These “step-downs” are staggered descents based on your DME distance. Reducing your altitude in steps ensures that you remain at a safe altitude as you approach the runway.

As you calibrate your height based on your distance from the runway, you can continue the descent to the minimum decision altitude (MDA) for the non-precision approach. At Aspen, the MDA for the non-precision approach is 10,200 feet. Once you reach this altitude, you must stop your descent unless you have the runway in sight and can continue the landing visually. You can continue your approach at (but not below) the minimum decision altitude until you reach the missed approach point, which is a specific distance, by DME, from the runway. If you cannot see the runway once you have reached the missed approach point, you must break off the approach and climb away.

18:48:04 The First Officer says, “Remember that crazy guy in this Lear[jet] when we were . . . on the ground in Aspen last time and he [stated that he could] see the airport but he couldn’t see it.” The Captain doesn't respond.

The visual approach into Aspen follows parallel to a highway which can be seen from the distance, clearly visible in the above aerial photograph.

18:49:28 The Captain asks the First Officer if he can see the highway. The First Officer can’t. “No, it’s clouds over here on this area I don’t see it.” The Captain responds with, “But it’s right there.”

18:49:34 The Captain then says, “Oh, I mean, we’ll shoot it from here, I mean we’re here but we only get to do it once.” He commented again that if the approach was not successful, they would need to divert to Rifle as it was too late in the evening to try again.

He doesn’t seem confident that he has the highway in sight, let alone the airport. However, he did not brief the missed approach procedure, which meant that the crew weren’t prepared for a missed approach even though it was seeming more and more likely that visibility was too low.

18:53:57 The flight attendant asks whether a male passenger can come into the cockpit and sit in the jumpseat. The cockpit voice recorder records the flight attendant asking a passenger to ensure his seatbelt is on, followed by the clunk of a seatbelt buckle being closed.

18:55:05 The Canadair Challenger 600 transmits his intention to execute another missed approach. The Captain comments, “The weather’s gone down, they’re not making it in.” An unidentified male voice in the cockpit responds with, “Oh, really.”

Flight crew members can’t engage in “any activity which could distract them from their duties” including non-essential conversation once the aircraft has descended below 10,000 feet msl. However the Gulfstream was above that altitude when the passenger came forward.

18:56:06 The Approach controller clears the flight crew for the VOR/DME approach and instructs them to cross the VOR at or above an altitude of 14,000 feet. The flight is five miles from the Red Table VOR, which is the initial approach fix.

18:56:23 The First Officer says, “After the VOR, you are cleared to twelve thousand seven hundred.”

18:58:00 The Approach controller asks the Canadair Challenger 600 whether he had the airport in sight, to which he replied, “Negative, going around.”

18:58:13 The unidentified male voice in the cockpit says, “Are we clear?” The Captain replies, “Not yet. The guy in front of us didn’t make it either.” He asks the First Officer for the next step-down altitude and the First Officer responds with the information.

For this segment of the approach, they needed to maintain 12,200 feet until they passed a point known as ALLIX, which is 6 DME (6 miles south of the Red Table VOR by DME), at which point they can descend to 10,400 feet. They actually passed ALLIX at 12,100 feet, 100 feet below the minimum specified altitude for that step.

18:59:30 The Captain calls for the landing gear and landing flaps. The First Officer states that the step-down fix at 10,400 feet is 9.5 DME (9.5 miles south of the Red Table VOR). He calls Three Greens (confirming that the nose and main wheels are down) and then that the missed approach point is 11 DME (1.5 miles further).

The missed approach point is the point at which they were required to break off the approach and follow the missed approach procedure unless they had the runway in sight.

The aircraft was at 10,400 feet and about 4.4 miles north of the airport. The Captain said, “Okay, I’m breaking out,” the first clear statement that he could see the ground. However, about 5 seconds later, he asked the Approach controller whether the runway lights were all the way up. The controller said, “Affirmative, they are on high.”

19:00:43 The Captain asks the First Officer whether he can see the runway. The First Officer’s response is unintelligible.

The aircraft has been descending at about 2,200 feet per minute but then levelled off at 10,100 feet, about 300 feet below the specified altitude for the step-down and also below the 10,200 foot minimum descent altitude, without any indication that the runway was in sight for either of the flight crew. The Captain neither corrected the descent nor initiated a missed approach. The First Officer did not challenge the Captain. The Captain asked if he could see the highway and the First Officer said, “see highway,” but it wasn’t clear if this was a statement or a simple repetition.

The descent continued about 10 seconds later. The Approach controller noticed that they have descended past the step-down altitude and the minimum decision height and asks them if they have the runway in sight. Within the cockpit, the First Officer said “Affirmative,” and the Captain said, “Yes, now we do.” The First Officer confirmed to the controller that the runway was in sight. At this point, they were at an altitude of 9,750 feet.

19:01:13 The First Officer says, “. . . to the right is good” and the aircraft turns slightly to the right as they continue their descent. They are now 900 feet below the minimum altitude. The First Officer should be monitoring the altitude and calling out the altitude deviation as they descend, but he says nothing about the altitude.

According to the radar data taken after the fact, the airport was actually to the left of the aircraft at that moment. The descent continued at a rate of 2,200 feet per minute.

19:01:21 A configuration alarm sounds to indicate that the spoilers have been deployed after the aircraft is configured for landing. The engine power is reduced at the same time, which will increase the aircraft’s rate of descent. The Captain likely is still trying to get under the snow showers so he can see, but on the Gulfstream the spoilers shouldn’t be extended when the aircraft is configured for landing, and the lower power setting does not meet the minimum power required for going around.

19:01:28 The Flight Profile Advisory unit announces 1,000 feet, their current height above the ground. The First Officer calls out, “one thousand to go.” Over the next few seconds, the unit announces 900 and 800 feet callouts.

19:01:36 The Gulfstream passes the missed approach point at an altitude of 8,300 feet, 485 feet above the airfield elevation, rather than the specified 2,385 feet above the field that it should be.

The First Officer should have called out that they had reached the missed approach point and whether the runway was in sight. The Captain should have announced his intentions. Instead, as they passed through the missed approach point, the Captain said, “Where’s it at?”

The Flight Profile Advisory continued its count down: 700 feet, 600 feet. They were below the minimum descent altitude, past the missed approach point, close to the ground, in mountainous terrain. It was insane to continue.

19:01:42 The First Officer says, “To the right.” The Captain repeats his words. The aircraft continues to bank gently to the right. The aircraft is flying over a low valley so the Flight Profile Advisory does not call out 500 feet. The terrain dropped over 700 feet lower than airport elevation and then rose again as the Gulfstream continued its ill-considered descent.

19:01:47 The aircraft stops turning to the right and begins a turn to the left. This is the first clear indication that the Captain had seen the airport.

The local controller saw the Gulfstream for the first time as it emerged from a snow shower and banked steeply to the left. It was west of the runway and at low altitude. She immediately reached for the crash phone.

19:01:49 The Ground Proximity Warning System sounds: SINK RATE, SINK RATE. The Flight Profile Advisory calls out 400 feet. The Gulfstream is banking to the left at 10º and the bank angle is increasing.

19:01:52 The engines are increased to maximum power. The Flight Profile Advisory unit calls out 300 feet. The Ground Proximity Warning System and Flight Profile Advisory unit both sound alerts at 200 feet above ground level.

19:01:57 A few seconds later, the Ground Proximity Warning System sounds the bank angle alert: the aircraft is banked about 40º, left wing down. Then the Cockpit Voice Recorder data ends.

The Gulfstream crashed into terrain 2,400 feet short of the runway 15 threshold, 300 feet to the right (west) of the runway centre-line and, at the point of impact, 100 feet above the runway threshold elevation. A 72-foot ground scar showed that the left wing touched the ground first, with the aircraft in a 49º left-wing-down attitude. The aircraft crushed up like an accordion. The three flight crew and fifteen passengers all died on impact from massive blunt force trauma.

On the surface, the cause is clear. The flight crew persisted in an unsafe approach in bad weather in mountainous terrain long after they should have turned back. However, as far as the FAA was concerned, Aspen was closed at night. A critical issue for the investigation was why the aircraft was cleared for the approach in the first place.

The problem came back to the Notice to Airmen (NOTAM) that had been released two days previously. A recent flight inspection led the FAA to decide that the areas of unlighted terrain could conflict with traffic patterns and thus it was unsafe to allow an instrument approach procedure at night. However the NOTAM stated that circling was not authorised at night, which was meant to imply that the instrument procedure was not allowed at night, as there are no straight-in minimums published for Aspen. With this vague wording, however, the First Officer may have understood that an approach was still authorised so long as no circle to land manoeuvre was done. Worse, the controllers at Aspen had not seen the NOTAM at all. As a result of human error, the Denver Center had never sent a copy to Aspen. The controller should have notified the flight crew about the NOTAM and it should have been included on the ATIS (recorded airfield and weather information) that the flight crew had listened to shortly before their approach. The controller did warn all aircraft on frequency that the visibility had dropped to 2 miles but he did not know about the NOTAM.

On top of this, night was early. The crash took place 34 minutes after official sunset, 7 minutes after the beginning of official night. However, in mountainous terrain, darkness doesn’t watch the clock. The Safety Board calculated that the sun had set below the mountainous terrain about 25 minutes before the “official sunset”, with civil twilight ending around 18:30 rather than 18:55. In addition, a dark shadow from a westerly ridge crossed the accident 79 minutes earlier than the official sunset. A controller commented that it was “very dark” previous to the accident.

Those issues are all safety nets. None of these issues explain why the flight crew continued this ill-fated approach in borderline conditions as night fell.

The flight crew were both experienced pilots who knew the local terrain and had done CRM/human factors training. Yet they continued on below the minimum decision height and past the missed approach point, despite the snowstorms and rapid darkness that blocked their view of the mountains surrounding the airfield.

The crew coordination wasn’t brilliant. The First Officer did not keep up with the callouts required on an instrument approach. The Captain didn’t go over the instrument approach procedure and more importantly didn’t go over the missed approach procedure, even when he was aware that the aircraft in front of him were having to execute it. Perceived pressure to land is generally associated with inexperienced pilots who manage to convince themselves that they must land the plane at all costs. And yet, they’d started the flight in clear agreement that they would attempt to get into Aspen once and if it wasn’t visual, they would divert to Rifle. So why did they suddenly fixate on getting into Aspen at all costs?

Initially, the Captain and his first officer discussed the location of the runway and the highway, both clear that they do not have it in sight. In retrospect, the First Officer’s comment is chilling: “Remember that crazy guy in this Lear[jet] when we were . . . on the ground in Aspen last time and he [stated that he could] see the airport but he couldn’t see it.”

A few minutes later, a passenger enters the cockpit and sits in the jumpseat. From this point on, there is no active discussion about how difficult it is to see the airfield, other than the Captain asking the controller if the runway lights were turned all the way up. They pass the missed approach and the minimum decision altitude and there is no evidence that they have visual contact with the runway. The controller noticed that they had descended past the step-down altitude and asked if they had the runway in sight. The two flight crew agree that they do, without any discussion as to what they’ve seen (the lights, the highway, or any other visual reference point). Neither crew member said anything about seeing the runway until directly asked, at which point they agreed in unison that it was there. The controller reported later that she could not see the aircraft when the First Officer reported that they had the runway in sight. Most damning, however, is that the aircraft turned to the right, when a left turn was required to align with the runway.

It’s not clear whether the jumpseat passenger was the client or one of his guests. The client had chartered the jet to take his guests to a party he was hosting in Aspen. The cascade of events that led to the crash actually started that afternoon when the flight crew arrived at Los Angeles International Airport but could not find the passengers. At 16:30, the charter company phoned the client’s business assistant to say that the passengers weren’t there. During that conversation, the business assistant was told that the latest time that the aircraft could depart was 16:55.

The business assistant discovered that all but two of the passengers were in the airport parking lot. The two missing passengers included his employer, the client. The flight crew collected the passengers who had arrived and boarded them onto the plane, explaining that if the other two did not arrive shortly, they would be too late to be able to land at Aspen. One of the passengers relayed this conversation to the client. The client told his business assistant to call the charter company and relay a message to the pilot that he should “keep his comments to himself.”

The business assistant told his employer that the flight might have to be diverted to Rifle and said that his employer became irate. The business assistant said that his employer told him to call the charter company and tell them that the airplane was not to be diverted. The employer told the business assistant to tell the charter company that he’d flown into Aspen at night before and he was going to do it again. The business assistant stated that he then contacted the charter company to express his employer’s displeasure about the possibility of not landing at Aspen.

The Gulfstream departed Los Angeles Airport at 17:11, forty-one minutes later than scheduled and 15 minutes past the latest time for departure given to the client. At 18:30, the Captain spoke to the scheduler at the charter company and told the scheduler that it was important that they land at Aspen because “the customer spent a substantial amount of money on dinner.”

The National Transportation Safety Board determines that the probable cause of this accident was the flight crew’s operation of the airplane below the minimum descent altitude without an appropriate visual reference for the runway.

Contributing to the cause of the accident were the Federal Aviation Administration’s (FAA) unclear wording of the March 27, 2001, Notice to Airmen regarding the nighttime restriction for the VOR/DME-C approach to the airport and the FAA’s failure to communicate this restriction to the Aspen tower; the inability of the flight crew to adequately see the mountainous terrain because of the darkness and the weather conditions; and the pressure on the captain to land from the charter customer and because of the airplane’s delayed departure and the airport’s nighttime landing restriction.

—From the official report

The day after the accident, the FAA issued a revised NOTAM from “circling not authorised at night” to “procedure not available at night”. Within the next fortnight, the charter company distributed a memorandum to state that airport operations at Aspen and three other airports were prohibited between sunset and sunrise. The memorandum, quoted in the official report, stated:

. . . if you cannot accomplish a landing and be on the ground at one of these airports before sunset you must divert to a suitable alternate. All passengers for one of these destinations must be informed of this policy. Flight crew members must report any violation of this policy or pressure from passengers to violate this policy to the Director of Operations or Chief Pilot.

—From the official report

New internal regulations were also put into place that only crew members, check airmen or FAA observers could use the jump seat. Under no circumstances are passengers allowed to move forward.

In the end, the poor cockpit resource management in the final minutes of the flight is the critical factor. The flight crew were staring out the window searching for the runway, rather than focusing on the flight. The Captain continued to descend past the minimum decision altitude in hopes of locating the airfield and the First Officer did not challenge the Captain’s actions nor call out the altitude as they descended into mountainous terrain.

However, understanding the contributing factors are what helps us to keep this from happening again. The FAA had already determined that night flight into Aspen was dangerous but the NOTAM was ambiguous and did not make the issue clear. The pressure from the client on the other hand, was clear and unambiguous: if the Gulfstream did not make it into Aspen, he was going to be very unhappy. Three other missed approaches were reported on the frequency and the weather was snowy and dark. Long after the Captain should have abandoned the approach, he continued to search for the runway, knowing he had only one chance to get into Aspen. The presence of the passenger in the jumpseat, especially if it was the charter client, could only have increased the pressure to get in. Rather than accept that they were going to have to abandon the approach and divert to Rifle, he and his First Officer kept trying to spot the runway, desperately attempting to come in safely after dark at one of the most demanding airport approaches in the country.

Traditionally, pilots are seen as confident and courageous. This tragic evening, the Captain was challenged to perform and he did his best to deliver, despite the adverse conditions. In modern aviation, we are finally acknowledging that cautious good judgement is a much more useful trait in pilots than confidence and courage.

Turning into the Dead Engine

THE TWO PILOTS WERE co-owners of VH-CNZ. She was a commercial pilot with over 10,000 hours, 600 of them on type. One blog post at the time said that she was a flight instructor. He was a private pilot with just over 2,500 hours and 120 on type. VH-CNZ was a Piper Twin Comanche which had just had a new propeller governor fitted on the left side. They were at Archerfield airport near Brisbane, taking the aircraft out to test the governor.

The Piper Twin Comanche is a very fuel-efficient twin, with four tanks: a tip tank and an auxiliary tank on each wing. The fuel tank fillers are on either side of the engine nacelle.

When the aircraft refueller arrived, the commercial pilot was sitting in the cockpit and the private pilot was doing the preflight checks. Conditions were good but it was late afternoon and the sun was low in the sky. The pilots may have felt under pressure to hurry before the sunset. After the plane was fuelled, the aircraft taxied to Runway 10 right for take-off.

17:14 CNZ Archer Tower Twin Comanche Charlie November Zulu is ready Runway 10 right departing to the southeast (male voice).

17:14 CNZ Runway right cleared for takeoff Charlie November Zulu (male voice)

Immediately upon take-off, the Tower controller spotted a cloud of “greyish black smoke” coming from both sides of the left engine. He contacted the aircraft immediately.

17:15 Tower Charlie November Zulu there is smoke coming from one of your engines (pause) it’s the left engine.

The aircraft passed the tower. There was sufficient runway and overrun to land the aircraft and “decelerate significantly” before reaching the boundary fence. They probably would not have stopped the plane in time; however it is likely that they would have only caused minor damage.

17:15 CNZ Charlie November Zulu affirm. We’re shutting it down and request a left turn back for landing (female voice).

Shutting down the engine in a twin propeller aircraft causes a thrust imbalance. The plane will yaw towards the inoperative engine. When turning into the dead engine, there’s a tendency to over-bank. The pilot must consistently counteract this imbalance.

In a conventional twin-engine propeller plane like the Piper Twin Comanche, the left engine is considered the “critical engine”. Shutting it down has a larger effect than shutting down the right engine, as a result of the asymmetric blade and disc effects. An example of this effect in a single engine plane is that the aircraft will tend to yaw to the left when using a clockwise turning propeller. In a multi-engine propeller aircraft, the engine with the down-moving blades produces more yaw, which in this case is the left. The shutdown of the left engine requires more pilot input to maintain straight flight than the right engine would.

The loss of the engine obviously also affects the flight performance of the aircraft. Initially, it is important to “clean up” the plane: to retract the landing gear and flaps, feather the inoperative propeller and ensure that the airspeed is maintained. This is especially critical at low altitude.

The flight crew shut down the left engine and the aircraft yawed sharply left and then to the right before commencing a left-hand circuit at 100 feet above the ground. The landing gear was extended throughout. The left engine was shut down but the propeller was not feathered.

The control tower cabin at Archerfield is 20 metres (65 feet) above ground level. The controller reported that as the aircraft flew past the tower, it appeared to be slightly below the tower cabin.

As the aircraft approached the western boundary of the airport, the aircraft turned left again. As it turned, the angle of bank suddenly increased. The Piper Twin Comanche was nose-down, inverted and rolling left when it impacted, 250 metres (820 feet) from the threshold of Runway 10. Both pilots were killed.

There was no evidence of fire. The left engine showed no signs of damage other than from the impact. No pre-existing fault of the propellers could be found. Based on the ground contact marks, the right engine was developing significant power at the point of impact. The left propeller was rotating but the engine was not developing power.

The left-wing fuel filler flap covers were open and both filler caps were missing. The caps were discovered on the runway and the adjoining clearway. The ground was wet under the inverted left wing where the fuel had poured out of the left tanks on impact.

The aircraft refueller recalled that the private pilot who was doing the pre-flight checks said that he would secure the caps after re-fuelling, as they were non-standard. Checking that the fuel caps are secure is a part of the standard pre-flight checks. The refueller stated that he filled the right tanks first and as he moved to the left side of the aircraft, he saw the pilot move towards the right tank. The refueller filled both the main and auxiliary tanks on the left side and placed the caps in the filler port of each tank. He did not secure the caps, as requested, and he left the flap covers open.

As the aircraft refueller finished, he saw the pilot lying beneath the fuselage, apparently conducting a fuel drain check. He told the commercial pilot, who was in the cockpit, that he had added 179 litres of fuel to the tanks and reminded her that the fuel caps were not secure.

The open flap covers were visible from the cockpit. The dark underside of the flap covers should have been clearly visible against the white upper surface of the wing. In any event, it is clear that the caps on the left wing were not secured and it is unlikely that the flap covers were closed.

They might have been in a rush, as the sun was setting and they wished to complete the test that afternoon. The pre-flight inspection may not have been completed. In addition, as a result of the failing light, the open flap covers on the wing may not have been as obvious.

As the aircraft rumbled down Runway 10 right for take-off, the caps fell from the left-wing filler ports. As the Piper Twin Comanche took off, the fuel vented from the open tank filler ports on the left wing. In the deteriorating light, the venting fuel from either side of the engine nacelle appeared as smoke to the tower controller and witnesses on the ground.

There’s no evidence that the pilots had any indication in the cockpit of a malfunction. It is unclear whether the pilots saw the “smoke” or recognised that the fuel flap covers were open. It appears they shut down the left engine based solely on the traffic controller’s report of smoke.

The aircraft should have been “cleaned up” before any manoeuvres were started. Instead, the pilot or pilots—it is not clear who was in control or that they were acting in a coordinated fashion—turned directly into the dead engine. The left engine propeller was not feathered, the landing gear was not retracted and, from the beginning, the aircraft was low and slow.

As they entered the third and final left turn, the cascading errors caused them to lose control completely.

SIGNIFICANT FACTORS:

The left wing fuel tank filler caps were not secured before takeoff.
Fuel vented from the left wing fuel tanks and had the appearance of smoke coming from the left engine.
The pilot(s) did not take the appropriate actions to maintain aircraft performance after shutting down the left engine.
The pilot(s) were unable to maintain control of the aircraft.

—From the official report

Both pilots had the training and experience to deal with such an emergency. The Piper Twin Comanche is capable of flying on one engine. We don’t know who was flying the aircraft and this may well have been a contributing factor if it was not agreed between them who was the pilot in command and making the decisions.

Even so, it’s hard to understand why the pilots reacted to a non-emergency in such an uncoordinated manner. In flight, all decisions have to take into account risk vs benefit. In this accident, the pilot(s) gave up all the benefit for increased risk and no gain.

The chain of events started with the fuel cap, which neither pilot took responsibility for. A pre-flight checklist includes checking that the fuel caps are secure but they were apparently in a rush. The sun was setting and the lighting was bad. When they received the incorrect report of smoke, they probably considered the recent work on the left engine propeller, making both pilots swift to presume a major fault. And as part owners of the Comanche, they may have been overly concerned about causing damage to the aircraft. They could have landed immediately, causing minor damage to the aircraft.

Having taken off, they could have flown on long enough to clean up the configuration and turn back safely.

Instead, clearly reacting under pressure, they turned off an engine that was still delivering full power, rather than taking the time to gain altitude and analyse the situation. They then compounded this error by turning back into the circuit without preparation.

The sad result is that a simple problem, a fuel cap not secured properly, turned into a tragedy.

Collision Course Over Tokyo

ON THE 31ST OF JANUARY, in 2001, two aircraft, a Boeing 747 and a DC-10, were flying over the sea near Yaizu City, in Japan’s Shizuoka Prefecture.

At 15:55 JST (Japan Standard Time) the pilots in both aircraft saw the impossible: an oncoming aircraft on a collision course. Understanding how this could happen in controlled airspace outside one of the busiest airports in the world takes some explaining.

There were four aircraft. The two flights directly involved in the incident, JAL 907 and JAL 958 are referred to by type: a Boeing 747 and a DC-10 respectively. The other two aircraft, JAL Flight 952 and American Airlines Flight 157, added to the confusion but were out of the way of the near miss and are only referred to by flight number. We’ll focus on the incident aircraft first.

Flight JAL 907 was a Boeing 747-400, registration JA8904, departing Tokyo and travelling to Naha.

15:36 The Boeing, carrying 16 crew and 411 passengers, departs Tokyo International Airport.

The Captain was in the left seat and in the role of Pilot Flying. In the right seat, a co-pilot trainee was the Pilot Not Flying (monitoring and offering support). The first officer and a copilot trainee were in the observer seats. The flight was departing and climbing.

15:41:16 The Boeing 747 passes 11,000 feet climbing to Flight Level 350 (35,000 feet).

The accident report includes detailed interviews with the flight crew that were taken directly after the incident, quoting their direct recollections from the event.

Boeing 747 Captain: “Our aircraft departed from Tokyo International Airport’s runway 34R at 15:35. The aircraft and engines were normal. I engaged the autopilot when we had accelerated to 250 knots at an altitude of about 5,000 feet. Before crossing MIURA point, we were instructed to turn right and were cleared ‘Direct YAIZU’.”

MIURA and YAIZU are waypoints that are used to route flights through the controlled airspace.

Boeing 747 Pilot Under Training: “There were no problems with the weather, which was extremely fine with good visibility and smooth air.”

Three air traffic controllers were on duty at the Kanto South C Sector of the Tokyo Area Control Centre. At the radar controller’s console was a trainee controller undergoing on-the-job-training with an ATC watch supervisor. The radar coordinator console was manned by an air traffic controller.

ATC Trainee: “At 14:30, I entered the IFR room for the shift change and from 14:40 I received on-the-job training at the Radar AG console of the Kanto South C sector. I think my current proficiency is about four out of ten. The traffic volume at the time of the on-the-job training was at about the level I could handle.”

15:42:12 The ATC trainee instructs the Boeing to fly direct to Yaizu NDB, which is confirmed.

A further aircraft, American Airlines Flight 157, was cruising at Flight Level 390 above Izu Oshima towards Kushimoto.

15:42:25 The ATC trainee controller instructs the Boeing to maintain flight level 350 (35,000 feet).

ATC Trainee: “I instructed [the Boeing] to maintain FL 350 until further advised. That was because there was the possibility of it converging over the Pacific Ocean with [the American Airlines flight] which was at FL390.”

15:46:38 The Boeing 747 continues to climb through flight level 216 (21,600 feet). The ATC trainee instructs the Boeing to climb to Flight Level 390. The Boeing confirms.

Meanwhile, Flight JAL 958, a Douglas DC-10-40 registration JA8546, was en route from Pusan to New Tokyo International Airport (Narita).

15:46:51 The DC-10 is handed over from Kanto South Sector B, an adjacent sector. The letters HND flash over the DC-10’s data block on the South C sector radar display.

The flight had been uneventful so far, but in just a few minutes the DC-10 would pass within metres of the Boeing.

There were three crew on deck. In the left seat and in the role of Pilot Flying was a Captain trainee (an experienced co-pilot preparing for an upgrade to command). In the right seat, the Captain was the Pilot Not Flying. A flight engineer was in the flight engineer seat. The flight was near its final destination of New Tokyo International Airport and so was flying level / descending.

15:47:02 The ATC trainee instructs American Airlines Flight 157 to descend to flight level 350, so that it is not at the same flight level as the Boeing. American Airlines Flight 157 doesn’t respond.

This was because American Airlines Flight 157 was not on frequency. The controller at South B Sector did not instruct the American Airlines flight to change frequency even though he had completed its hand-off to South C Sector.

Meanwhile, at South C Sector, the supervisor decided that the altitude separation between the Boeing and the American Airlines flight needed to be established quickly and so the ATC trainee was attempting to establish radio contact early.

15:47:14 A fourth aircraft, JAL Flight 952, requests clearance to fly directly to a fix near New Tokyo International Airport (Narita). The ATC trainee asks the aircraft to stand by.

15:47:47 Someone at South C Sector inputs the command to receive the hand over of control of the DC-10.

In the cabin of the Boeing 747, the cabin crew turned on the TV news and prepared the drinks trolley. A few minutes later, when turbulence had died down, the cabin crew started the drinks service.

The ATC Trainee at South Sector C attempted again to call the American Airlines flight, with no response. He also speaks to the fourth aircraft, JAL Flight 952, which has a similar flight number to the DC-10.

The two flight numbers may have become conflated in his head. In any event, it appears that he forgot the presence of the DC-10 entirely.

The Boeing 747 followed the instructions and turned left over the YAIZU waypoint. It was now at FL370 (37,000 feet) and flying directly towards the DC-10.

Computers don’t forget. In the control room, a conflict alert flashed on the display, showing the collision path of the Boeing 747 and the DC-10. Usually, a conflict alert would display at least three minutes before the predicted loss of separation. But because the Boeing 747 was turning, it was not clear that they were on a collision course. The conflict alert was issued a mere 56 seconds before the predicted collision.

The ATC Trainee saw the flashing conflict alert with only seconds to go. He decided that the DC-10 needed to descend to avoid the conflict. That was a logical decision: the Boeing 747 was climbing and could continue to climb. The DC-10 was level and ready to descend for its approach into New Toyko International Airport. Requesting it to descend should have ensured the vertical separation between the two aircraft.

So, the DC-10 needed to descend and the Boeing could continue its climb and the collision course would be averted.

Unfortunately, the ATC Trainee got his flight numbers confused. He tells the Boeing to descend to FL350, instead of the DC-10. From this point on, everything happens too fast to be able to effectively follow the timestamps.

ATC Watch Supervisor: “At around the end of my explanation, the conflict alert was flashing in the data blocks of [the Boeing 747] and [the DC-10]. I was in a flurry because I had forgotten about the presence of [the DC-10]. At that point in time, I deemed that the best decision was to descend [the DC-10], and so even though the trainee actually made [the Boeing 747] descend, I was convinced that he had issued the instruction to [the DC-10]. When the trainee had issued the descent instruction—which I later realized had been for [the Boeing 747] — when [the Boeing 747] read back the instruction, I heard something like the sound of an alert in the background.”

That alert that he heard in the background was a traffic advisory from the Traffic Collision Avoidance System in the Boeing 747.

A Traffic Collision Avoidance System (TCAS) is installed into all modern commercial transport aircraft . It interrogates the transponders of all nearby aircraft, receiving their altitude and distance. The TCAS offers traffic advisories to alert the flight crew of nearby aircraft. When the flight crew receives a traffic advisory (TA), they are not expected to perform avoidance manoeuvres, simply to be aware that there is the possibility of a conflict, in which case the TCAS will offer a resolution advisory (RA). It gives the flight crew a chance to locate the other aircraft visually and prepare for the next instruction.

TCAS predictions are based on the assumption that aircraft are flying straight. In this instance, as the Boeing turned onto the flight path of the DC-10, the TCAS triggered late.

DC-10 First Officer (Pilot Flying): “While we were flying from XMC to XAC, around about the time an RA went off, I couldn’t make out whether it was for “907” or “957” but I heard a ‘Descend’ command in a fairly faint voice. It was after that, I believe, that I became aware of the TCAS display showing traffic at 12—13 nm at FL370 without an arrow pointing upward or downward. At the same time I sighted the traffic at 10—11 o’clock. I wondered why the traffic was at the same altitude as us.”

Boeing 747 Captain: “After the left turn, as our aircraft was approaching FL370, we were instructed by Tokyo ACC to ‘DESCEND FL350’. I understood that this was to maintain separation from the traffic, and thought that the controller intended to have our aircraft pass below the traffic because the situation was not yet critical. Since the controller handles multiple aircraft with a grasp of the whole traffic situation, we followed the instruction to descend.”

The Captain disengaged the autopilot and the autothrottles for a manual descent. The momentum of the aircraft takes it up to FL372 (37,200 feet) at which point it begins to descend. The Boeing 747’s descent starts just a few minutes after the drinks service has begun. A passenger in the back of the Boeing 747 stated, “it occurred around the time I was starting to relax, looking at Mt. Fuji from the right-side window.”

DC-10 Captain (Pilot Not Flying): “As we saw the other aircraft turning over YAIZU, a TCAS ‘TRAFFIC, TRAFFIC’ TA sounded while we were about 10 nm distant at FL370. The other aircraft’s altitude was also displayed as FL370. The PF disengaged the auto-throttles in anticipation of a resolution advisory.”

Both aircraft were now at the same level (37,000 feet) and flying directly towards each other.

If the TCAS determines that there is a real risk of collision, and if the other aircraft is also TCAS-equipped, the TCAS will send a coordination signal to the other aircraft in order to resolve the encounter.

In this way, the evasive manoeuvres are coordinated: one TCAS system will select an “upward sense RA” (instructing the pilot to climb) and the coordination signal to the second TCAS means that the second system will select a “downward sense RA” (instructing the pilot to descend), thus resolving the conflict immediately.

The DC-10 flight crew saw the Boeing 747 turning over YAIZU. They received a traffic advisory (TRAFFIC, TRAFFIC) to alert them to the presence of the Boeing 747, which had been climbing and was about 10 nautical miles away. The First Officer (Pilot Flying) disengaged the auto-throttles, expecting a resolution advisory from the TCAS. For the avoidance of doubt, a TCAS display shows an arrow next to the other aircraft to show whether it is climbing or descending.

The Boeing 747, which had been climbing, followed the instruction from the ATC Trainee and now was descending. The TCAS resolution advisory alerted the crew to the conflict with a clear instruction: CLIMB, CLIMB, CLIMB.

The Captain, having already begun his descent, stated, “I will continue to descend.” The Boeing 747 continued its descent, contrary to the direct instruction received from the TCAS.

Boeing 747 First Officer: “I did not think that the ‘DESCEND FL350’ instruction [from ATC] was smart but I considered it plausible. We had already made visual contact with the other aircraft, so I thought that the instruction would have been to avoid it. After the TA alert, the RA ‘CLIMB, CLIMB, CLIMB’ sounded, but I don’t exactly remember the time interval between them. At that point in time, however, as the descent had already been initiated following the ‘DESCEND FL350’, with the thrust levers closed and aircraft already at descent pitch, the captain continued manoeuvring to descend while stating ‘we’re already descending, so we’ll descend’. At that time, following the TCAS RA, reapplying maximum power and pitching up to comply with the RA command, at an altitude of what I thought was around 37,000 ft, would have been extremely dangerous.”

Boeing 747 Captain: “At that time, I observed the other aircraft approaching from the forward right at about the same altitude, but I had already initiated a descent and judging that the best way to avoid a collision at that altitude would be to continue descending contrary to the TCAS command, I continued descending to FL350. Further, I also considered the risk of stalling if we pitched up given the insufficient thrust, leading to an even more dangerous situation. The other aircraft appeared to be about in level flight at FL370.

This was a completely unexpected decision. When you receive a resolution advisory from your TCAS system, you must follow it. The TCAS coordination with other aircraft is based on the assumption that both aircraft will comply with the instructions. It’s clear that the flight crew were concerned about going directly back into a climb; however, at the very least the Captain should have stopped his descent which was in clear opposition to the resolution advisory of CLIMB, CLIMB. There’s a clear training issue here. The Captain of the Boeing 747 did not appear to understand that the TCAS of the DC-10 would be given a corresponding advisory. If he was receiving the instruction to CLIMB then the conflicting aircraft would receive the instruction to DESCEND. He seemed to hope that the DC-10 would remain in level flight. He should have known that it would descend.

At South Sector C, the supervisor and trainee had not noticed that they told the wrong plane to descend. They did not know that TCAS resolution advisories had kicked in, which overrode their instructions. In this situation ATC transmissions should be kept to a minimum to avoid conflict and confusion . . . but the controllers needed to know that the aircraft had been issued resolution advisories.

The Boeing 747 continued to descend in line with the direct instruction from ATC. As the flight crew had not complied with the TCAS instruction to climb, they may not have seen it as important to inform the controllers that a resolution advisory had been issued. Pilots are taught set phrases in order to quickly inform ATC of TCAS resolution advisories. There is no procedure in place for an aircraft that is following ATC instructions contrary to a resolution advisory. The Boeing 747 had already confirmed its compliance to the instruction to descend, so no further call was made.

Meanwhile, the DC-10 flight crew had complied with the resolution advisory from the TCAS but had not informed ATC.

The Aeronautical Information Circular, quoted in the official report, states that:

“Pilots who deviate from an ATC clearance in response to an RA shall promptly return to the terms of the previous ATC instruction or clearance when the conflict is resolved and they shall notify the appropriate ATC unit by use of the following phraseologies as soon as possible on the radio frequency.”

—From the official report

This implies that ATC can be notified once the conflict is resolved, as opposed to when the resolution advisory is received, which in fact is what the DC-10 did. During the incident, no radio calls were made.

Thus, ATC still considered itself responsible for avoiding the conflict. Also, neither the ATC trainee nor his supervisor had realised that the trainee mistakenly told the Boeing 747 to descend. The aircraft continued on their collision path.

The ATC trainee instructed the DC-10 to change heading to 130°. He did not receive a response as the DC-10 was completely focused on following the TCAS and looking for the traffic. The primary concern now should have been to provide vertical separation between the aircraft, but the supervisor decided against correcting the trainee’s heading instruction. The DC-10 continued descending in response to the resolution advisory. It did not change heading and did not respond. The trainee then instructed the DC-10 to fly heading 140° and again received no response.

At this point, the supervisor took over the radio communications. Unfortunately, she made things worse.

The supervisor conflated the flight numbers (JAL 907 and JAL 958) and instructed Flight JAL 957 to descend. As Flight 957 did not exist in her airspace, she did not receive a response.

There were a total of six radio communications from South Sector C. All six messages either involved errors or were not received/understood. Not a single communication actually helped to avoid the collision rapidly approaching.

Boeing 747 First Officer: “I did not hear a TCAS ‘increase’ RA command. ATC was communicating something but I was too busy to understand the communications. I felt that the distance from the other aircraft at the closest point was around 10 meters.”

The First Officer, who was Pilot Not Flying, should have been monitoring the TCAS traffic display, which would have made it clear that the DC-10 was descending with a large, downward facing arrow. Instead, his statement, and the statements of every crew member in the Boeing 747 all described in detail the approach of the DC-10. No one was monitoring the instruments. Everyone was looking outside.

DC-10 Captain (Pilot Not Flying): “Before long, the TCAS ‘DESCEND, DESCEND, DESCEND’ RA activated and the PF disengaged the autopilot, set power to idle and lowered the nose little by little. Since the descent rate at this time was less than 1,000 ft/min, I exerted forward pressure on the control wheel while advising ‘Lower it further. ’ Immediately thereafter, the TCAS ‘INCREASE DESCENT, INCREASE DESCENT’ sounded. Judging that we had to descend rapidly, I called ‘I’m pulling speed brakes’ while pulling the speed brakes to full. The PF lowered the nose further. I switched on the seat belt sign.”

The DC-10 Captain was supporting his first officer with advice (“lower it further”) as well as fulfilling his responsibilities as Pilot Not Flying (speed brakes, seat belt sign). He wasn’t staring out the window in horror, he was reacting.

Boeing 747 Captain: “As the relative distance to the other aircraft remained unchanged, I thought that without further action we would collide and pitched down even further. After that I saw the other aircraft appear to pass from right to left at about eye level. I indicated in the Captain’s Report that the closest vertical separation from the other aircraft was approximately 10 meters. While we were manoeuvring to pass just below the DC-10, it appeared to fill the forward right window but we were able to avoid a midair collision.”

The Captain of the Boeing 747 increased his descent, insistent on flying beneath the DC-10. The aircraft were within metres of each other and both were trying desperately to dive beneath the other.

The Boeing 747 pitched down abruptly in response. The cabin attendants flew to the ceiling, striking the ceiling panels, and then crashed down to the floor. One galley cart smashed through the ceiling panel and became lodged between the air conditioning ducts and a supporting beam. Seven passengers and two cabin attendants were seriously injured and 81 passengers and ten cabin attendants received minor injuries, including burns from the hot beverages.

DC-10 Captain (Pilot Not Flying): “Glancing outside at that time, I saw the other aircraft approaching from the forward right. Finally it appeared to be approaching rapidly. It appeared to be descending in the same way as us, I could visually see the top of the fuselage, and I judged that it was increasing its descent rate, so I felt that the situation was extremely dangerous. I think the PF felt the same, but we had no time to communicate and we both pulled back on the yokes almost simultaneously.”

Honestly, I think both the Captain and the First Officer (Pilot Flying) deserve an award for gauging the situation and pulling out of the dive to allow the Boeing 747 to pass beneath.

DC-10 First Officer (Pilot Flying): “It felt as if the other aircraft was rapidly rushing toward us, and I wondered why since our aircraft was following the TCAS descent command. Subsequently, I saw the other aircraft become larger and lower its nose when it was just off the tip of our left wing or a little bit inward of that. At that point in time, judging that the attitude of the other aircraft was around 10—15° nose down, at the same altitude as us, and descending, I quickly applied power and pulled the control wheel. The other aircraft was so close that I thought its tail would snag our aircraft.”

DC-10 Captain (Pilot Not Flying): “I knew that it was nose down, because I could see the top of its fuselage. I had the impression that the other aircraft was descending at the same altitude as us and was considerably nose down. Seeing that situation, I judged there was nothing that could be done but to pull.”

The investigation report is not quite as effusive as I am and simply states that as the flight crew of the DC-10 consisted of a Captain, a Captain in Training and a Flight Engineer, they may have had a higher level of judgement compared with a regular flight crew complement.

The Boeing 747 levelled off at FL350 and reported to Kanto South Sector C that it was clear of the conflict. It was a few minutes later before it reported a near-miss with a DC-10.

DC-10 Captain (Pilot Not Flying): “Subsequently, while returning to FL370, I informed ATC that ‘We have descended following a TCAS alert. We are now climbing through 35,500 ft for FL370’. This was the first radio communication we made after the two aircraft crossed. ATC replied only ‘Roger’.”

The near-miss took place at an altitude between 35,000 and 36,000 feet. The DC-10 was in level flight, ready to descend. If the Boeing 747 had been above 36,000, there would never have been any risk of a collision.

At the beginning of the incident, the Boeing 747 was climbing. If it had continued to climb without further instructions, it would have reached an altitude of approximately 38,100 feet. The initial ATC call mistakenly telling the Boeing 747 to descend put the aircraft on a collision course.

Aircraft testing showed that the swift change in direction would have caused buffeting but there was no risk of a stall and the altitude would have easily increased by 1,400 feet. So in the worst-case scenario, if the Boeing 747 had responded to the ATC instruction to descend but then reversed the descent once the TCAS display showed the DC-10 as descending, it would have safely climbed to approximately 36,200 feet.

In every instance, there would have been sufficient vertical separation to avoid the collision without further evasive manoeuvres.

The Probable Cause from the official report could be stronger, in my opinion. Note that Aircraft A is the Boeing 747 (Flight JAL 907) and Aircraft B is the DC-10 (Flight JAL 958).

It is considered that the accident was caused as follows:

A Conflict Alert (CNF) was issued at Tokyo ACC warning of the proximity of Japan Air Lines flight 907 (Aircraft-A), which was making a climbing left turn, and Japan Air Lines flight 958 (Aircraft-B), which was cruising in level flight. While responding to this conflict alert, Tokyo ACC mistook the flight number of Aircraft-B for that of Aircraft-A, and instructed Aircraft-A, which was climbing at the time, to descend.

Immediately after Aircraft-A initiated a descent in response to this instruction, its Traffic Alert and Collision Avoidance System (TCAS) issued a Resolution Advisory (RA) to climb, but Aircraft-A continued the descent in compliance with the ATC instruction. Both Aircraft-A and Aircraft-B which descended in response to its own TCAS RA, came to abnormal close proximity while maintaining mutual visual contact, and just before their closest point of mutual approach both aircraft made evasive maneuvers to avoid a collision based on visual judgment. Aircraft-A made an abrupt descent intending to pass under Aircraft-B just before their flight paths crossed, and as a result passengers and cabin attendants (CA) of Aircraft-A rose from the cabin floor or seats, floated, then dropped and sustained injuries.

—From the English translation of the official report

The Captain’s decision to disregard a resolution advisory from the TCAS is completely unacceptable. His response at the time and his explanations afterwards make it clear that there is a training issue; he was quite simply unaware of the consequences of his decision to continue the descent against the resolution advisory. This is furthered by the fact that the rest of the crew (which was overall less experienced than the crew of the DC-10) equally did not see it as odd that the Captain ignored the resolution advisory and were busy staring out of the window rather than monitoring the TCAS, which would have told them exactly what the DC-10 was doing.

The number of errors in the ATC handling of the incident is frightening; however it does seem clear that the ATC Trainee was out of his depth, which again, I would class as a failure of the system, rather than assign blame to the trainee. He clearly tried to deal with the emergency to the best of his ability, which quite simply wasn’t good enough. The supervisor relieved him late and compounded the error, which is indicative of a greater failing within the ATC training at Kanto.

Nevertheless, in 2004, the ATC Watch Supervisor and the ATC Trainee were charged with professional negligence in causing injuries to passengers in the aircraft. They were later cleared, as their instructions were not the direct cause of the accident, because the pilots should have followed the Resolution Advisory rather than the controllers. However, the Tokyo District Public Prosecutor’s Office filed an appeal and in 2008, a higher court overturned the decision and found both guilty, sentencing the trainee to one year and the supervisor to 18 months. Both sentences were suspended for three years.

This is a sad example of the fact that when systems and processes fail, it is far easier to blame individuals at the end of the line, rather than improve the environment and training that led to the failure.

Unexpected Spin

THE 12TH OF MAY in 2001 was a fine day in the south of England. Stapleford Aerodrome in Essex had blue skies with a surface wind of 10–12 knots from the northeast: a perfect day for flying. That’s what made it all the more surprising when G-ARIE, a Piper PA-24-250 Comanche (a popular four-seater, single engine plane), entered a steep spiral descent and crashed into the ground during a standard flight.

The pilot was a part owner of G-ARIE. He’d been flying since 1992 and this was simply a check ride. The Joint Aviation Requirements dictate that pilots revalidate their licences every two years and his last revalidation for single-pilot, single-engine rating was in July 1999. So he organised a one-hour dual flight in the G-ARIE with a qualified flight instructor. The instructor sat in the right seat but, for the purposes of a check ride, he is considered to be the commander. He had been a qualified flying instructor since 1991.

The pilot had taken G-ARIE out the previous week and the flight was uneventful. When he started up the plane that day, there was a single backfire but no other unusual events were reported. The pilot and his instructor took off at 15:15.

The radar recordings showed that after take-off, the aircraft flew east and then northeast, directly towards the area of Osea Island. There were two brief deviations where the aircraft turned approximately 60° to the right before turning left back onto track. The plane’s ground speed was approximately 120 knots for the first six minutes of the flight and then decreased to 60 knots for about four minutes. The speed increased to 140 knots over the next minute and then decreased again to 60 knots.

The aircraft was last seen over Osea Island where there were other aircraft doing aerobatics and a jet aircraft flying past at low-level.

Two witnesses said they saw G-ARIE carrying out manoeuvres before entering a steep spiral descent. Others said it had been flying straight and level before going into the dive. The check flight should have consisted of general airwork: climbing at best angle and best rate; straight and level cruising flight, steep turns, recovery from stalls and recovery from incipient spin.

The Piper PA 24-250 Comanche is not cleared for aerobatics or intentional spinning; however all of the standard manoeuvres were well within the tolerances of the aircraft. The flight controls of the Comanche remain effective down to stalling speed and stalls are gentle and easily controlled. In addition, it is standard procedure to do clearing turns before carrying out stalls and there was no evidence of any such precaution prior to the spin. It did not appear that the spiral dive was the result of intentional manoeuvres.

A pilot flying a Yak 11 in the local area saw G-ARIE go into the spin to the right. He originally thought it was part of a training routine but then became puzzled as it continued to spin. He flew towards the plane and said that it did four to six complete turns before impact. The pilot called emergency on 121.5Mhz but there is no evidence of any emergency call from G-ARIE.

The eyewitnesses agreed that they saw the aircraft spinning continuously until it hit the ground. They heard little or no engine noise as it descended towards the earth and there was neither fire nor explosion when it struck the ground.

Examination of the accident site showed that the aircraft had struck the ground in a very steep nose-down attitude, estimated to be 70/75° to the horizontal. There had been no significant translational movement of the aircraft after the initial impact, consistent with an essentially vertical descent, and the relative lack of fragmentation of the wreckage indicated a relatively low vertical speed of, probably, between 60 and 80 kt. There was a clear impression of where the wing leading edges had struck the ground, the imprint of the right wing being slightly lighter and curved whilst that of the left, was straight and heavier.

—From the official report

In addition, the three blades of the propeller had folded straight backwards with only slight signs of “circumferential scuffing”. This indicates that the propeller had been rotating at the time of impact but with very little power applied. Thus, the wreckage and ground marks told the same story as the eyewitnesses: the aircraft was slowly spinning in a steep nose-down attitude with little engine power when it impacted the ground.

The postmortem examinations showed raised CO levels in both pilots, higher than would be seen in even the heaviest of smokers. Both men had inhaled an extremely large amount of carbon monoxide.

Carbon monoxide is colourless, odourless and tasteless—it is impossible to detect using your senses. It is in the smoke and fumes emanating from the exhaust systems of aircraft engines and combustion heaters.

If you inhale CO, it combines with the haemoglobin in your blood, which causes oxygen starvation in the body and the brain. The initial symptoms are subtle: mild tiredness, a feeling of warmth, tightness across the forehead. Later symptoms include headaches, dizziness, nausea, tiredness, confusion and shortness of breath or difficulty breathing. A form of hypoxia, CO poisoning causes confusion and impaired judgement. As the poisoning continues it causes problems with balance, vision, memory and eventually loss of consciousness and death.

The pilots hadn’t put the plane into an intentional spin and lost control, as might have been originally been presumed. Much more likely was that both were incapacitated and unable to fly the plane.

It’s quite possible that the pilots themselves, confused and disoriented, mishandled the controls as they succumbed to the poisoned air in the cockpit. Or G-ARIE might have entered the spin as the result of wake turbulence: the radar returns showed that a minute earlier, another aircraft had flown past the location where G-ARIE appeared to go out of control. Regardless of what caused the initial upset, it is clear that the pilots were not able to recover.

Carbon monoxide can enter the cockpit in a number of ways: cabin heaters may use the engine exhaust pipe as a heat source or the gases can enter from the outside. However, a sudden high onset such as this is generally caused by a leakage in the engine exhaust system which finds its way into the aircraft through ineffective seals, access panels, skin joints or through cabin fresh-air intakes. Any ineffective seals in the plane can result in reduced cabin pressure, which means that if there is a leak, the exhaust gas is drawn into the cockpit through the lower fuselage.

There, they found that although the No. 5 manifold stub pipe was severely twisted from the crash, there was clear evidence that the flange and the stub pipe wall had cracked right through prior to the impact. They found both fatigue fractures and evidence of tearing overload.

The remaining owners of G-ARIE stated that the exhaust manifolds had been changed relatively recently but there was no evidence in the aircraft log books for this. The owners produced an invoice, dated 22 January 1999, which apparently related to the right-hand manifold. This invoice was the only documentation associated with the fitting of the new manifold. The invoice stated that the manifold had been manufactured and inspected in accordance with airworthiness regulations. However, the manifold part number on the invoice was not listed in the aircraft parts catalogue nor does it relate to any other design of manifold approved for the aircraft.

Investigators discovered that the failed manifold did not conform to the design of the approved parts. The exhaust manifold stub pipes from cylinders 1, 5 & 6 had reinforcing doubler plates welded over the basic stub pipes. Piper Aircraft stated that the changes made to the exhaust were likely to cause localised and unpredictable thermal stress cycles. The reinforcing doublers welded on would also have changed the thermal and stress cycles in the pipe and doubler, especially at engine start-up. As a result, the single thickness part of the pipe was subjected to undue and unexpected thermal expansion and stress effects. In addition, the doublers protected the fracture from sight, allowing it to develop to a critical length before it was possible to detect the fracture with a visual inspection.

The maintenance records for the aircraft showed that G-ARIE had an annual inspection in June 2000 and had recently undergone a 50-hour/6-month check. Examination of the exhaust system is a requirement for both of these inspections; however as there was no record of the new manifold in the aircraft log books, there was no evidence that a new one had been wrongly fitted. There was no way of knowing that there had been any difficulty with the installation, let alone that the pipes had unauthorised doubler plates welded on. The only way to inspect the area where the fracture first manifested could only have been done using a mirror and light: an additional check unlikely to happen without any reason to suspect an issue in the exhaust manifold. And so, despite undergoing all the requisite inspections, the crack remained undetected, with additional stress every time the engine was started.

As G-ARIE had recently been flown without ill effect, it seems likely that the fracture in the exhaust pipe became critical the day of the crash, either at engine start or early in the flight. The fractured pipe leaked large amounts of exhaust gas which entered into the cockpit, disabling the pilots.

As a result of this incident, the UK Air Accidents Investigation Branch recommended that carbon monoxide detectors be required on all piston-engined aircraft. If G-ARIE had had a carbon monoxide detector fitted in the cockpit, they would have been aware of the presence of the gas before they were incapacitated and almost certainly could have returned to the airfield safely and with minimal ill effect. At the very least, said the AAIB, the Civil Aviation Authority “should vigorously promote that all such aircraft should have a current carbon monoxide detector fitted to facilitate an early warning of the presence of this gas.”

When One Engine Isn’t Enough

IT WAS A ROUTINE 150-hour inspection when a technician found metal chips in the oil filter of the right engine of the Learjet. The maintenance company who usually carried out repairs to the aircraft did not have the parts available and with only a maximum of twenty flight hours allowed after finding the chips, it was urgent to get the repairs done at once. On the 7th of February 2001, two pilots and the chief technician ferried the plane from its base in Rome to Nürnberg, where the right engine was repaired and certified. The Learjet was already booked for a charter flight from Rome for the 9th of February so they planned a swift return after the maintenance was done, flying direct Nürnberg to Rome on the 7th.

The Learjet 35A was a business jet with two Garrett TFE731-2-2B turbofan engines. The aircraft type was introduced in 1976 and currently holds the record for the fastest around-the-world flight. The Italian business airplane was built in 1981.

The flight prep was carried out by phone from the repair facility. It was a fine day: visibility of 10 kilometres or more and cloud bases not below 5,000 feet with moderate wind. Everything looked great.

During the pre-flight checks, the pilots noticed an unbalanced fuel distribution between the right and left-hand tip tanks. They discussed the problem and decided it wasn’t an issue, as the total fuel quantities on both sides were equal. The First Officer (Pilot Not Flying) noted that his gyro instruments had failed. The chief technician took a look and confirmed that they could run the flight and replace the gyro system once back in Rome.

The Learjet taxied to runway 10 and were given clearance for departure via Nördlingen to Rome. They took off at 15:31.

Upon departing Nürnberg, the flight crew should have contacted Nürnberg Radar immediately. This is clearly marked on the plates but although the first few minutes of the flight appear to have been quiet and without problems, the crew did not change frequencies. The aircraft flew directly towards Nördlingen climbing towards their cruise altitude of FL70 (7,000 feet).

At 15:33:49, a little less than 3 minutes after take-off, the Learjet was at an altitude of 5,900 feet with an airspeed of 250 knots and had just made a right turn in line with their route. That was when the left-hand engine failed with no warning.

Witnesses on the ground said they heard the sounds of an engine running down. Neither smoke nor fire was visible.

The First Officer immediately contacted Nürnberg Tower and reported an emergency: the left engine had failed. He informed Nürnberg that they wanted to return immediately for a landing on runway 10. It was visual conditions and they had the runway in sight.

The Tower Controller acknowledged the emergency and asked the Learjet to contact Nürnberg Radar on 118.97.

This was such an incredibly wrong-headed thing to do, it makes my teeth clench. The crew had declared an emergency. It doesn’t matter that they should have switched to Nürnberg Radar immediately after departure. They declared an emergency.

The correct response from the Tower Controller should have been to acknowledge the emergency (which the controller did), offer any information that might help, for example the wind information and whether the runway was clear (which the controller didn’t) and then phone Nürnberg Radar to explain the situation, leaving the pilots to deal with the emergency.

The accident report refers to the request for a frequency change as “extremely problematic” but then explains that the controller did not know “to what extent the reported emergency had an effect on the flight characteristics of the aircraft.”

This, quite frankly, was not the controller’s problem. It was an emergency; he should have treated it as such. There was no conflicting traffic, the aircraft was returning to the airfield, the whole exchange was simply unnecessary. The flight crew should have refused the frequency change.

The First Officer changed frequency to Nürnberg Radar and declared an emergency. Nürnberg Radar cleared the aircraft for a visual approach to runway 10 and asked whether radar assistance was required. Upon being told that radar assistance was not required, Nürnberg Radar asked the crew to switch back to frequency 118.3 for Nürnberg Tower.

The final flight of the Learjet, from engine failure to crash, took ten minutes. These radio calls and frequency changes used up almost two minutes.

The flight crew contacted Nürnberg Tower again and received clearance for runway 10. Nürnberg Tower asked whether airport fire services should be on standby. Apparently, the crew did not understand the question immediately. As a result, Nürnberg Tower asked them to confirm again that they had declared an emergency.

None of this conversation was as important as flying the plane. Nürnberg Tower should have been taking all possible actions to give assistance to an aircraft that was in distress. Instead, it provided pointless distractions.

Despite the interruption, the flight crew had plenty of time. The airport was clearly visual and the weather was good. It should have been possible to return to the airfield without problems.

Inside the cockpit, the voice recordings show the increased strain on the pilots. They should now have followed the checklist for engine failure—shut down in flight. But they didn’t. The Pilot in Command asked for the descent checklist and then the before landing checklist which are used under normal circumstances.

The pilots sped through the checklists, only partly completing them. The runway was in sight and they were descending normally. Up until the final approach, everything looked fine. Six miles out, the flaps were set to 8° and then to 20° and the landing gear extended. The working right-hand engine was set to idle as they came in for their landing.

However, a Learjet with only one engine doesn’t handle the same way, which is why the standard checklists should not be used. The crew never looked at the airspeed needed for an approach with an engine failure. They never looked at the flap settings. They set up the plane as if it were a normal landing.

The procedure for a single engine landing includes the possibility of landing with full flaps “if the landing is ensured”. In the case of an engine failure, it is safer (and more common) to come in with 20° flaps and only extend fully if you are sure that you are going to land on the runway, especially if you fear that you don’t have enough runway in which to stop.

The Learjet would have required 915 metres (3,000 feet) to land that day. Nürnberg’s Runway 10 is 2,700 metres (8,850 feet).

And yet, still some distance away from the threshold, they set full flaps, 40°. The airspeed immediately dropped but they hadn’t reached the runway yet. At that speed, they wouldn’t make it.

The pilot immediately set the right-hand engine to full power and shouted, “Flaps 20!” followed a moment later by “Do it!” With full power coming from the right, the airplane yaws to the left. They are a couple of hundred feet above the ground and about one kilometre away from the runway.

The Learjet could not reach the required airspeed with the flaps fully extended. Increasing the thrust to full power was too late and caused the plane to yaw violently. Retracting the flaps brought the slow airspeed even closer to stall speed.

And finally, the asymmetric fuel in the tip tanks meant the Learjet was even more unstable than normal.

In the small town of Buch, witnesses saw the aircraft make reeling movements as it turned left at a low height. It appeared to turn towards the runway again but then the aircraft tumbled. The witnesses said they saw the Learjet rocking from side to side with a Dutch roll motion before it completely stalled and crashed into the forest.

It’s not clear whether the pilot planned to go around or was still trying to reach the runway. He might not have known himself. In those final moments, there was no time to consider decisions.

The airport fire service, which had been alerted previously, were in standby position and rushed to the forest, reaching the accident scene within minutes. The wreckage was 230 metres (750 feet) north of the threshold.

The investigation focused on the left engine, to find out why it had failed. They discovered “inter-granular cracking” or fractures on the high-pressure turbine disk, which caused the failure.

The engine had done 5,200 cycles, that is, 5,200 take-offs and landings, which was over the maximum prescribed . . . by a mere 157 cycles. The engine was at the end of its service life but only just. It did not seem likely to have this type of fault at that age. However, once the investigation focused on the turbine disk, they discovered all was not as it seemed. When the turbine disk was installed into the engine, the previous cycles had not been counted correctly.

Once they looked into the history of the disk, it became clear that the high-pressure turbine which had supposedly only had around 2,500 cycles had been the victim of noncompliant cycle counting. In reality the turbine had already accumulated 6,582 cycles before it had been installed into the engine of the Learjet and had already exceeded the allowable maximum of 5,200 cycles.

After installation, the engine and the turbine disk had completed a further 2,731 cycles. Thus, the high-pressure turbine disk had done 9,313 cycles when the engine shut down. The left engine was quite simply an accident waiting to happen.

Causes:

The accident was caused by an in-flight failure of the left power plant appr. 3 minutes after take-off and an inadequate conduct of the subsequent single-engine landing procedure so that in short final the airplane stalled and crashed from low height.

The failure of the left engine was caused by intergranular fractures of retention posts on the high-pressure turbine disk. As a result of incorrect service life recordings the maximum number of cycles had considerably been exceeded.

Safety Recommendations: None.

—From the English translation of the official report

I rarely argue with an accident investigation but this conclusion strikes me as the second greatest failure of the accident. The whole point of an investigation is to identify and understand the failures and look at how we can stop the situations arising that caused the accident.

This accident report is extremely problematic in that it simply waves away the problem without looking at how and why the pilots got it wrong. The ATC handling, increasing stress and using up over two minutes of pilot focus during a ten-minute flight, should in my opinion be listed as a contributing factor. The report cites that the pilots sounded stressed and followed the wrong checklists but does not then look at human factors to analyse why.

A single engine failing in a twin engine within view of a modern airport should be an incident, not a lethal accident.

Twin Towers

I WONDERED WHETHER to include this tragedy at all. On the one hand, it seemed bizarre to even consider aviation incidents of 2001 and not include 9/11. On the other hand, over ten years have passed and surely everything has already been said.

In order to make up my mind, I read the 9/11 Commission Report. It was the first time I’d read the report in full. Over the years, I’ve thought about individual events of that terrible morning but until now, I’ve not been able to think about the attacks as a whole. Reading the commission report, I found myself envisioning the unfurling of the attacks minute by minute.

There is nothing new in my analysis below, simply a change in viewpoint. Rather than looking at each plane individually, I focused on the straightforward timeline of that morning and how the information spread during the initial flights.

Tuesday, September 11, 2001, dawned temperate and nearly cloudless in the eastern United States. Millions of men and women readied themselves for work. Some made their way to the Twin Towers, the signature structures of the World Trade Center complex in New York City. Others went to Arlington, Virginia, to the Pentagon. Across the Potomac River, the United States Congress was back in session. At the other end of Pennsylvania Avenue, people began to line up for a White House tour. In Sarasota, Florida, President George W. Bush went for an early morning run.

—From The 9/11 Commission Report

The following timeline is extracted from The 9/11 Commission Report: Final Report of the National Commission on Terrorist Attacks Upon the United States (Authorized Edition).

06:45 Mohamed Atta and Abdul Aziz al Omary arrive at Logan International Airport in Boston, Massachusetts. Atta, Omary, as well as Satam al Suqami, Wail al Shehri and Waleed al Shehri check in for American Airlines Flight 11, bound for Los Angeles with a scheduled departure of 07:45. In another terminal at Logan Airport, Marwan al Shehhi, Fayez Banihammad, Mohand al Shehri, Ahmed al Ghamdi and Hamza al Ghamdi check in for United Airlines Flight 175, bound for Los Angeles with a scheduled departure of 08:00.

07:03–07:39 At Newark Liberty International Airport in New Jersey, Saeed al Ghamdi, Ahmed al Nami, Ahmad al Haznawi and Ziad Jarra check in for United Airlines Flight 93, bound for San Francisco with a scheduled departure of 08:00.

07:15 At Washington Dulles International Airport, Khalid al Mihdar and Majed Moqed check in for American Airlines Flight 77, bound for Los Angeles with a scheduled departure of 08:10. They are joined by Hani Hanjour and the Hazmi brothers, Nawaf and Salem.

Several of the hijackers are flagged as a risk and, as a result, selected for extra screening of their checked bags. Two of them set off alarms with their carry-on bags but pass a second test. Two of the hijackers have their checked bags held until they board the aircraft. No other consequence follows the screening.

07:23–07:48 The five hijackers of United Airlines Flight 175 board the plane and take their seats in business class.

07:30 The five hijackers of American Flight 11 board the plane and take their seats in business class.

07:39–07:48 The four hijackers of United Flight 93 board the plane and take their seats in the first-class cabin.

07:50 The five hijackers of American Airlines Flight 77 board the plane and take their seats, two in coach, three in first-class.

Nineteen men are now aboard four transcontinental flights and ready to initiate their attack. The security screening did not stop them. Although the hijackers later claim to have bombs, this is almost certainly a bluff.

08:14 American Airlines Flight 11 acknowledges navigational instructions from Boston ATC.

16 seconds later, ATC instructs the flight crew to climb to 35,000 feet. No response is received from the pilots.

08:19 On American Airlines Flight 11, Flight Attendant Betty Ong uses an airphone to contact the American Airlines Southeastern Reservations Office and report an emergency aboard the flight. Flight Attendant Amy Sweeney also contacted American Airlines to report and relay updates.

A few minutes later, the microphone is keyed and air traffic controllers hear the hijackers’ transmissions meant for the cabin. The first transmission is not clearly understood by the controller. The second transmission is broadcast clearly and the controller realises that the plane has been hijacked: “Nobody move, everything will be okay. If you try to make any moves, you’ll endanger yourself and the airplane. Just stay quiet.”

The message of the first transmission is not understood until an hour later. The hijacker had said: “We have some planes. Just stay quiet, and you’ll be okay. We are returning to the airport.”

08:26 Flight Attendant Betty Ong reports that American Airlines Flight 11 is flying erratically. The aircraft turns south.

08:34 Boston Center controller receives a third unintended transmission from American Airlines Flight 11. “Nobody move please. We are going back to the airport. Don’t try to make any stupid moves.”

08:37 Northeast Air Defense Sector are contacted by Boston Center. This is the first notification received by the military that American 11 has been hijacked.

You can’t blame them for the initial response: “Is this real-world or exercise?” It swiftly becomes clear that this is a real emergency, and Northeast Air Defense Sector order two F-15s to battle station.

08:42 United Airlines Flight 175 flight crew report a suspicious transmission overheard from another aircraft: “Ah, we heard a suspicious transmission on our departure out of Boston, ah, with someone, ah, it sounded like someone keyed the mikes and said ah everyone ah stay in your seats.”

08:44 Contact with Flight Attendant Betty Ong on American Airlines Flight 11 is lost. Flight Attendant Amy Sweeney reports that they are in a rapid descent and flying “way too low”.

08:46 Two F-15 fighters are scrambled but Northeast Air Defense Sector do not know where to send them.

08:46:40 American Airlines Flight 11 crashes into the North Tower of the World Trade Center.

08:47 United Airlines Flight 175 changes transponder codes twice within a minute.

The controller responsible for this flight is desperately trying to locate American Airlines Flight 11 and does not notice.

08:51 United Airlines Flight 175 deviates from its assigned altitude. The air traffic controller attempts to contact the aircraft and receives no response.

08:51 American Airlines Flight 77 transmits its last routine radio communication.

08:52 A passenger and a flight attendant on United Airlines Flight 175 make phone calls from the cabin to report the hijacking.

08:54 American Airlines Flight 77 deviates from its assigned course, turning south.

08:56 American Airlines Flight 77 transponder is turned off. Controllers attempt to contact the aircraft but do not receive a response.

Indianapolis Center reports that the aircraft has had a serious electrical or mechanical failure and possible crash.

09:00 American Airlines Executive Vice President Gerard Arpey learns that communications have been lost with American Airlines Flight 77 and grounds all American Airlines flights in the north east.

09:00 The passenger on United Airlines Flight 175 phones again, reports that the plane is making jerky movements and passengers are throwing up.

09:03:11 United Airlines Flight 175 strikes the South Tower of the World Trade Center.

09:03 Boston Center staff analysing the hijacker transmission from American Airlines Flight 11 realise that the initial message included the phrase “we have some planes” and the scale of the attack becomes clear.

Controllers at Boston Center request that Herndon Command Center “get messages to airborne aircraft to increase security for the cockpit”. There is no evidence of Herndon taking this action.

09:12 Passengers on American Airlines Flight 77 make phone calls from the rear of the cabin to report the hijacking.

09:19 United flight dispatcher begins transmitting warnings to the 16 United transcontinental flights currently in the air.

09:20 Indianapolis Center become aware of the situation in New York and realise that American Airlines Flight 77 may also have been hijacked and reports the aircraft as lost.

09:23 United Flight 93 receives a warning message from the United flight dispatcher. The pilot responds asking for confirmation.

09:38 United Flight 93 suddenly drops 700 feet. A Mayday message is broadcast with sounds of a physical struggle in the cockpit.

09:29 The autopilot on American Airlines Flight 77 is disengaged. The aircraft is at 7,000 feet and approximately 38 miles west of the Pentagon.

09:30 Northeast Air Defense Sector scramble fighters at Langley after a report of a hijacked aircraft heading for Washington DC.

However, they are told that it is American Airlines Flight 11 that is heading towards Washington, although it had already crashed into the South Tower.

The fighter jets are given an easterly heading to send them to the Baltimore area to position between a non-existent southbound American Flight 11 and Washington DC. Their flight plan did not include a distance nor the target’s location.

09:32 Controllers at Dulles Terminal Radar Approach report a primary radar return, tracking eastbound at high speed.

A National Guard C-130H cargo aircraft follows the track and identifies a Boeing 757. He’s found American Airlines Flight 77.

09:32 United Flight 93 announces “Ladies and Gentlemen: Here the captain, please sit down keep remaining sitting. We have a bomb on board. So, sit.” The autopilot is used to turn the aircraft around and head east.

The passengers and flight crew begin phoning to report the incident and are told of the crashes into the World Trade Center.

09:34 American Airlines Flight 77 is 5 miles west-southwest of the Pentagon. The aircraft begins a 330-degree turn and descends through 2,200 feet. The hijacker advances throttles to maximum power and dives toward the Pentagon.

09:36 Boston Center reports “Latest report. Aircraft VFR [visual flight rules] six miles southeast of the White House. . . . Six, southwest. Six, southwest of the White House, deviating away.”

The mission crew commander at Northeast Air Defense Sector takes control of the airspace to clear a flight path for the Langley fighters which are well out of range. “I don’t care how many windows you break,” he says.

09:37:46 American Airlines Flight 77 crashes into the Pentagon at approximately 530 miles per hour.

09:38 The National Guard C-130H cargo aircraft which was attempting to follow American Airlines Flight 77 reports “it looks like that aircraft crashed into the Pentagon Sir.” The Langley fighters are still about 150 miles away.

09:39 A further radio transmission is received from United Flight 93: “Uh, this is the captain. Would like you all to remain seated. There is a bomb on board and are going back to the airport, and to have our demands [unintelligible]. Please remain quiet.”

The point of turning off the transponders is to make the planes “disappear” from a controller’s point of view. These attempts to hide the hijacked aircraft clearly added to the confusion of the morning.

09:58 The hijacker flying United Flight 93 rolls the aircraft left and right in an attempt to knock the passengers off balance. He tells another hijacker to block the cockpit door and continues to roll the plane.

09:59 United Flight 93 is about 20 minutes flying time from Washington DC. The hijacker pitches the nose of the aircraft up and down to disrupt the assault.

10:00 The hijacker flying United Flight 93 stabilizes the aircraft and asks “Is that it? Shall we finish it off?” He receives a response from another hijacker, “No. Not yet. When they all come, we finish it off.” The pilot pitches the aircraft up and down again.

Another aircraft reports to controllers that he has seen the plane “waving his wings”.

10:01 United Flight 93 stabilizes again and the hijackers agree to “put it down”.

10:02:23 United Flight 93 plunges and the control wheel is turned hard to the right, rolling the aircraft onto its back. It crashes into an empty field in Shanksville, Pennsylvania, travelling at approximately 580 miles per hour.

10:07 Northeast Air Defense Sector receive notification of United Flight 93’s hijack.

10:08 The National Guard C-130H cargo aircraft, which had resumed its planned flight to Minnesota, reports black smoke fifteen miles south of Johnstown. It is confirmed as corresponding to the last known position for United Flight 93.

All four aircraft were successfully hijacked and were crashed on purpose. Only three reached their targets.

Every person involved must have been so full of horror and fear as the events unravelled. I’m not ashamed to admit that after I finished putting together this timeline, I cried.

Negative Training:
When the Simulator Lies

IT WAS THE 12TH of November, 2001. The dust had not yet settled in the gap in New York’s skyline when American Airlines flight 587, an Airbus A300, crashed into Queens. Flight 587 was a scheduled passenger flight from New York to Jamaica with 251 passengers, 7 flight attendants and 2 flight crew. The aircraft arrived at JFK at 22:31 the night before the accident. The morning flight was the first leg of a one-day round-trip for the flight crew. All times are Eastern Standard Time (local time for the flight).

06:14 The Captain checks in for the flight. The First Officer arrives 15 minutes later.

The pair had flown together 36 times before the accident. Both were excellent pilots. They got along well.

08:59:58 The ground controller clears Flight 587 to push back from the gate.

The First Officer was Pilot Flying. The First Officer pressed each pedal down, maxing out at 3.7 inches on the right and 3.6 inches on the left and responded, “rudders check”. The full displacement on the rudder pedals is 4 inches.

09:11:08 The controller clears Japan Air Lines for take-off. The JAL flight is a heavy Boeing 747, which requires a minimum of 2 minutes or 4 nautical miles separation. The controller adds extra radar separation between the Boeing 747 and the A300 as 747s “are often slow climbers” and clears Flight 587 to taxi into position and hold, with a caution about the wake turbulence.

09:13:28 The controller notes that separation is established and clears Flight 587 for take-off.

09:13:35 “You happy with that [separation] distance?” asks the First Officer. The Captain is happy. “We’ll be all right once we get rolling. He’s supposed to be five miles by the time we’re airborne, that’s the idea.” There’s no cause for concern.

09:13:51 Flight 587 takes off. The climb-out is normal. They are separated from JAL flight 47 by at least 4.3 nautical miles horizontally and 3,800 feet vertically throughout.

09:15:36 The aircraft encounters mild wake turbulence. The First Officer responds with very aggressive movements on the control column.

09:15:41 The Captain acknowledges an instruction from the departure controller to proceed directly to their next point of reference. This is the final transmission that the controller receives from flight 587.

09:15:44 The Captain says to the First Officer, “Little wake turbulence, huh?” The First Officer responds with “Yeah” and requests 250 knots, which is the maximum speed for flight below 10,000 feet msl. At this time, the aircraft is at approx 2,300 feet msl.

09:15:51 The Airbus encounters more wake turbulence. There’s slight bumpiness and the plane’s left wing drops, causing a slight roll to the left. Again, the First officer responds aggressively. He moves the control wheel to the right and depresses the right rudder pedal, hard. The aircraft responds to his manoeuvre by rolling to the right. The First Officer moves the control wheel rapidly left and right, with a series of alternating full rudder inputs.

09:15:54 The First Officer, in a stressed tone, asks for max power. The aircraft is travelling at 240 knots. The Captain does not change the power setting but instead asks, “You all right?” The First Officer replies, “Yeah, I’m fine,” but the strain is clear in his voice.

09:15:55 The Captain offers words of support, “Hang onto it. Hang onto it!”

09:15:58 The aircraft is travelling at 251 knots when a loud bang sounds in the cockpit. The right rear main attachment fitting has fractured. The aerodynamic load on the vertical stabiliser is extreme. The vertical stabiliser rips off under the pressure.

The vertical stabiliser, also known as the fin, is the vertical section of the tail on the Airbus A300. An aircraft cannot fly without a vertical stabiliser.

09:16:00 The Cockpit Voice Recorder records a grunt and then the First Officer cursing. A sound similar to a stall warning chimes for 1.9 seconds.

09:16:07 The First Officer says “What the hell are we into . . . we’re stuck in it.”

Both crew members still somehow believed that this was wake turbulence. The First Officer’s aggressive rudder input in response to the perceived turbulence caused the entire upset and now had stressed the aircraft beyond its structural limits. The plane, no longer airworthy, began to fall out of the sky.

Northwest Airlines flight 1867 was lined up on runway 31L ready for departure. The Captain saw pieces falling from the A300 ahead and then watched the aircraft enter a nosedive and crash. Four homes were destroyed and six others damaged. 260 people aboard the aircraft and five on the ground were killed in the impact.

The media frenzy was immediate. In the wake of 9/11, terrorism was an obvious conclusion. What else could make a plane break apart in the sky? The initial speculation was that there must have been a bomb or some other deliberate act to destroy the aircraft.

But the Flight Data Recorder told another story. The vertical stabiliser was ripped off of the aircraft because of the stresses that the pilot had put the plane under in the course of the flight.

During both bouts of turbulence, the First Officer responded very aggressively with excessive force. When the left wing dropped, which was not in itself a cause for concern, the First Officer depressed the right rudder pedal, hard. The aircraft responded to this manoeuvre by rolling to the right, which should have been expected. The First Officer responded with a series of fast and excessive corrections, moving the control wheel rapidly left and right, with a series of alternating full rudder inputs over the next seven seconds.

The investigation was able to prove that the structural damage was not a result of a flaw in the aircraft. There was no structural fault with the fin. The composite materials were strong enough to withstand normal pressures. The design of the A300-600 vertical stabilizer exceeded certification requirements.

The “limit load” of the stabiliser is the maximum that the stabiliser is expected to bear. The ultimate load is the limit load multiplied by a safety factor of 1.5. An aircraft is expected to experience limit load only once in its lifetime and it is never expected to actually experience ultimate load.

At 240 knots, the rudder pedals on the A300-600 required 30 pounds of force to achieve full rudder deflection. The First Officer applied 140 pounds of pressure during the seven seconds before the break-up. The Captain never realised that the increasing sideslips and rolls of the aircraft were not caused by unexpected wake turbulence. However, the ongoing “turbulence” was the direct result of the First Officer’s forceful left-right-left-right on the rudder pedals.

The continued rudder deflections led to increasing sideslip angles that produced extremely high aerodynamic loads on the vertical stabiliser. When it snapped, the strain was double the limit load, more than any structure on the aircraft can be expected to bear.

Why had the First Officer reacted with such force to the wake turbulence encounter? An encounter which was so minor, it actually required no reaction from the cockpit at all.

A flight engineer reported that in 1997, the same First Officer was flying a 727 on approach, 7 miles out at an altitude between 3,000 and 5,000 feet. They encountered wake turbulence from a 737 in front. The First Officer responded by immediately applying full power and executing a go-around. As the 727 was the larger aircraft and there was more than sufficient altitude, a go-around was a clear over reaction to the encounter. The flight engineer recalled it as one of the more memorable events in his flying career.

In a separate report, a 727 captain recalled that the aircraft encountered wake turbulence when the First Officer was flying. The captain said the encounter required only a small aileron input to roll the airplane to wings level. The First Officer responded very aggressively on the rudder pedals.

Specifically, the captain indicated that, when the airplane was at an altitude of between 1,000 and 1,500 feet, the first officer “stroked the rudder pedals 1-2-3, about that fast.” The captain thought that the airplane had lost an engine and was thus focused on the engine instruments. The captain stated that he then asked the first officer what he was doing and that the first officer replied that he was “leveling the wings due to wake turbulence.” The captain, who had his feet on the rudder pedals, thought that the first officer had pushed the rudder to its full stops.

The captain recalled being startled by the first officer’s rudder inputs and indicated that they did not level the wings but created left and right yawing moments and heavy side loads on the airplane. He further indicated that the first officer did not need to be so aggressive because the 727 was “a very stable airplane.”According to the captain, he and the first officer discussed this event later in the flight. The captain pointed out to the first officer that his use of the rudder pedals was “quite aggressive,” but the first officer insisted that the American Airlines Advanced Aircraft Maneuvering Program (AAMP) directed him to use the rudder pedals in that manner.

The captain disagreed with the first officer and told him that the AAMP directed that the rudder was to be used at lower airspeeds. The captain told the first officer to review the AAMP when he returned home and to be less aggressive on the rudder pedals when they flew together.

—From the official report

The AAMP, Advanced Aircraft Maneuvering Program, is an advanced training for dealing with upsets in aircraft attitude put on by American Airlines. In 1996, a review of accidents from 1987 to 1996 showed that the leading causal factor for accidents involving large multi-engine transport-category aircraft was loss of control. There were conflicts between the manufacturers’ advice and the training being offered by the airlines. The chief flight test pilots from Airbus, Boeing and McDonnell Douglas joined the working group in order to offer unified advice as to airplane handling and recovery techniques.

Two of the areas in which the airplane manufacturers and the airlines had differing opinions were the use of rudder and the use of simulators. Regarding the use of rudder, the Airbus chief test pilot indicated that the existing upset recovery simulator training courses emphasized using rudder for roll control at low airspeeds. He stated that, although the rudder remained effective down to very low airspeeds, the airplane manufacturer test pilots were “very wary” of using rudder close to stall speed.

—From the official report

American Airline’s AAMP consists of classroom instruction, manuals, videotapes and simulator flight training. In 1997, shortly before the above incidents, the First Officer had attended ground school training and read the AAMP training manual.

Aircraft manufacturers were unhappy with the airplane upset recovery training being offered by the airlines, including specifically the AAMP training offered by American Airlines. They formally complained about the specific courses, including the AAMP offered by American. The chief test pilots from Airbus, Boeing and McDonnell Douglas banded together (an unexpected alliance) to try to convince the airline training managers to de-emphasise the use of rudders in their courses. They warned the airlines that excessive rudder could cause excessive sideslip, leading the pilot to lose control of the aircraft, exactly as happened on American Airlines Flight 587 four years later.

Internally, an American Airlines A300 technical pilot wrote a letter in 1997 to express his concern that the AAMP encouraged the use of rudders as primary roll control. The letter specifically stated that the AAMP instructors were teaching pilots to use the rudder to control roll in the event of a wake turbulence encounter.

Airbus tried to convince American Airlines to change the course. The chief test pilot wrote a letter to American Airlines to state that the rudder should be used to avoid sidelip but not as the primary source of roll. He also wrote that simulators were particularly inaccurate for large sideslip angles and the pilot could draw the wrong conclusions. The vice president of Airbus also voiced his concern about the AAMP’s emphasis on rudder and their simulator use for upset recovery training.

Boeing weighed in with a letter addressing the same issues and in regards to the upset training, said, “the excessive emphasis on the superior effectiveness of the rudder for roll control vis-à-vis aileron and spoilers, in high angle of attack, is a concern.”

The Boeing chief test pilot said that he vehemently disagreed with the aggressive use of rudder at high AOAs because “it is extremely dangerous and unpredictable.”

The McDonnell Douglas chief test pilot expressed “serious concerns and disagreement” about the rudder theories presented in the AAMP.

The American Airlines managing director of flight operations technical was quoted in an internal memo that he had “grave concerns about some flawed aerodynamic theory and flying techniques that have been presented in the AAMP.” The memo also said that it was wrong and exceptionally dangerous to teach pilots to use rudder as the primary means of roll control in recoveries from high AOAs.

Nevertheless, American Airlines defended the AAMP and the rudder and continued training pilots with a combination of ground school and simulator exercises.

A closer look at the simulator training showed disconcerting similarities to Flight 587. The standard simulator exercise went something like this:

The pilot is told that he is taking off behind a heavy 747 and issued the appropriate wake turbulence warnings, which meant he should expect a wake turbulence encounter after take-off.

During climb-out, at an altitude between 2,000 and 2,500 and an airspeed of 240 knots, he experiences some light chop. The simulator inhibits the use of controls for up to ten seconds in order to ensure that the simulation will reach an excessive bank as per the training. The pilot is told to react quickly to the upset; however anything the pilot does with the control wheel and rudder pedal inputs during this stage of the exercise has little or no result.

The aircraft rolls in one direction (determined arbitrarily by the computer) and then almost immediately rolls in the opposite direction to at least 90º. The controls remain inhibited until the airplane reaches 50º, when yaw and roll control are phased back in. Rudder input is required as a part of the recovery technique.

The First Officer has no record of unusual rudder use before his AAMP training in 1997. However, the AAMP manual he received as a part of his ground training in 1997 stated directly that the use of rudder was the most effective roll control device at high angles of attack. (The manual was revised in 1997 as a result of manufacturers’ concerns, but the First Officer never received the revised version.) During classroom training, pilots were instructed that full rudder inputs could be appropriate in certain extreme situations, despite manufacturers warnings to the contrary. It was after the First Officer had received this training that he overreacted to the turbulence on approach. When the First Officer defended his heavy rudder usage on the 727 to his Captain on the second event, he explicitly stated that the AAMP directed him to use the rudders in that manner in a wake turbulence scenario.

Then he continued his training, including four simulator sessions. The simulation encouraged his aggressive reactions, and misrepresented the aircraft’s actual response to large rudder inputs.

Flight 587 took off after a heavy 747 and they were advised of possible wake turbulence. The aircraft rolled slightly to the left. The First Officer responded with full right rudder, which in the simulator would have had little or no effect, as the controls were inhibited. In reality, the aircraft sideslipped and rolled aggressively to the right as a result of his aggressive response. But if we look at it from the First Officer’s point of view, the aircraft responded with a hard roll to the right, just like in the simulation.

The First Officer almost certainly had no idea that the airplane’s motion was caused by his overreaction, rather than the wake turbulence. And so he continued exactly as he had in the simulator, responding with an aggressive input to the left.

Except the simulation didn’t end. The “turbulence” became worse. And although he’d been trained for this encounter, nothing that he did was anything like what it had been on the simulator.

American Airlines immediately blamed the design of the A300, saying that it was flawed. It was true that the A300 rudder pedals were more sensitive than any other aircraft out there. It was also clearly true that the pilots—and the instructors, it seemed—were not aware that the sensitivity of the pedals increased dramatically at higher airspeeds.

Airbus responded with a bulletin on rudder use, which stated directly: Sudden commanded full, or nearly full, opposite rudder movement against a sideslip can generate loads that exceed the limit loads and possibly the ultimate loads and can result in structural failure. The bulletin also clarified that rudders should not be used to induce roll or to counter roll when induced by turbulence.

American Airlines A300 feet standards manager argued that they had never received such limitations nor prohibited manoeuvres on rudder use before the accident. Nevertheless, it was clear that Airbus, Boeing, McDonnell Douglas and American Airline’s own managing director of flight operations technical had all stated clearly, four years previously, that the training encouraged dangerous flying techniques, especially in regards to rudder usage.

The Safety Board agreed that the Rudder Control System Design in the Airbus A300-600 had much higher sensitivity that other transport-category aircraft. The variable stop design meant it became more sensitive as airspeed increased, rather than a relatively constant rudder pedal sensitivity. The use of rudder at high airspeeds is rare and this sensitivity would not have an effect on standard rudder use (for example, during a crosswind landing or engine-out). However, it did mean that relatively small pedal displacements in the cruise could lead to maximum rudder movement. At 240 knots, only 30 pounds of pressure was required to reach full rudder deflection. The flight data recorder from Flight 587 showed that the First Officer applied up to 140 pounds of pressure during the accident sequence. A less sensitive pedal would not have saved him.

The Safety Board concluded that the A300-600 was specifically susceptible to potentially hazardous pedal inputs at higher airspeeds. However, they agreed with Airbus that the situation should never have arisen:

To elevate the characteristics of the A300-600 rudder system in the hierarchy of contributing factors ignores the fact that this system had not been an issue in some 16 million hours of testing and operator experience—until the AAMP trained pilot flew it.

—From the official report

Despite this, the National Transportation Safety Board listed both as contributing factors:

The National Transportation Safety Board determines that the probable cause of this accident was the in-flight separation of the vertical stabilizer as a result of the loads beyond ultimate design that were created by the first officer’s unnecessary and excessive rudder pedal inputs. Contributing to these rudder pedal inputs were characteristics of the Airbus A300-600 rudder system design and elements of the American Airlines Advanced Aircraft Maneuvering Program.

—From the official report

The order of the contributing factors is because the Board wanted more attention to be given to aircraft rudder characteristics, although two members of the board actively voted against the hierarchy as given, for fear that it diminished the role of the AAMP in the accident.

In the end, the First Officer, considered an experienced and competent pilot by his contemporaries, was flying the plane exactly as he believed he had been trained to. Negative training is a situation in which training leads to less effective performance in the operational environment than would have occurred if no training had been conducted. The Advanced Aircraft Maneuvering Program was supposed to improve his skills and make him a safer pilot. Instead, it did the opposite. If the First Officer had not taken part in the AAMP, he and his passengers might be alive today.

The strength of this accident report is that it didn’t stop at the first cause, even though it was clear early on that the rudder inputs by the Pilot Flying had caused the disaster. Investigators delved further, not content with the easy answer. And in the end, they were able to show exactly how the pilot had come to this point and thus how to avoid it in future. Although the situation is tragic, this report is a triumph of aviation investigation.

Conclusion

THE STRENGTH OF ACCIDENT investigations is that they are not simply a blame-allocation exercise. One of the reasons that aviation is now so safe is because every accident is treated seriously, rather than dismissed the moment someone is found who could be held accountable.

In aviation, we take it seriously that we can learn from the mistakes of others, and accident investigations must remain strongly biased towards “stop this from happening again” rather than allocating blame. I hope that with these analyses, it’s possible to see the progress towards safer aviation around the world.

This is only a small selection of accidents from around the world. I have chosen especially dramatic events which are interesting to dissect and understand, so it would be unreasonable to try to draw greater conclusions from such a small number. These flights have one factor in common: they occurred within a twelve-month window. But from this selection alone, it is clear that accidents are not simply a matter of aircraft size, hours in the cockpit or lack of modern computer aids.

The accidents and incidents of 2001 also shed light on how vigilance and understanding have made certain classes of incidents more rare: windshear, uncontrolled fire, avionics confusion, uncontained engine failure, structural failure. These accidents are not a single point of failure but an unfortunate combination of events. The sequence of events leading to the failure has become a critical part of the analysis.

Many changes have come into effect since these accident investigations took place. Airbus have changed the logic of their flight control system. American Airlines have modified their advanced pilot training. The FAA have run a promotional campaign recommending carbon monoxide detectors. And of course, we have experienced first hand the changes around the world in airport security as a direct result of the most tragic air incident in 2001. This reactive process can be frustrating: even when safety is increased, each new regulation or recommendation adds complications. Despite all this investigation and analysis, some new combination will always occur. However, this focus on the fine detail and the true causes of every accident is also the reason why flying is still the safest form of travel (six times safer than travelling by car and twice as safe as rail, according to the BBC), despite constant increase in traffic.

Why Planes Crash Case Files: 2001 is an entry-point into 21st century aviation. I hope that the analyses have offered a clear view of aviation in 2001 and the trials and tribulations of the modern pilot. If you enjoyed this book, please email me at [email protected] to let me know. You can also visit http://planecra.sh/2001 for the references and original accident reports.

Why Planes Crash Case Files: 2002 is available at all fine bookstores. For the full list of online resellers, please visit: http://planecra.sh/book/2002/.

The latest book in the series tells you how to write off a Saab 2000, shares the few details available about the Skynyliv airshow disaster, as well as covering two in-flight suicides and a runway collision, and includes an in-depth analysis of the Überlingen midair collision.

For many, aviation still brings with it an air of mystery, a century-long magic trick. Though most of us will board an aircraft at some point in our lives, we know little about how they work and the procedures surrounding their operation. It is that mystery that makes these losses, such as the vanishing of Malaysia Airlines flight 370, so terrifying.

Without a Trace explores the most interesting of these disappearances: mysteries that have baffled investigators for years. Occasionally tragic, frequently amusing, Without a Trace begins just before the golden age of aviation with a manned balloon swept over the English Channel, and ends with a top-secret spy plane disappearing at the height of the cold war. Each case is laid out in rich detail and presented chronologically, highlighting the historical context, official accident reports and contemporary news surrounding each mystery.

Sylvia Wrigley introduces the crews, innocent bystanders and rescuers in this collection of true stories. Documenting the popular theories from each case, she uses her knowledge and experience as a pilot and an aviation journalist to demystify aviation jargon and narrow down each disappearance to the most likely explanations.

The stories encompass airships, military jets and commercial airlines—all of which have vanished without a trace.

About the Author

SYLVIA WRIGLEY is a pilot and aviation writer who has been obsessing about aviation safety for over a decade.

Why Planes Crash: Case Files 2001

Why Planes Crash

Case Files: 2001

Acknowledgements

CONTENTS

Introduction

Lost in the Fog

Using Propellers as an Airbrake

Nose Down into the Runway

Snow in the Engine

Can You See What I See?

Turning into the Dead Engine

Collision Course Over Tokyo

Unexpected Spin

When One Engine Isn’t Enough

Twin Towers

Negative Training:
When the Simulator Lies

Conclusion

About the Author